CyberSunil/LLMVault

What it is

LLMVault (CyberSunil/LLMVault), a self-hosted Flask app you run locally to practise OWASP-LLM-Top-10 (2025) attacks. The summary covers the labs and Live Mode; what it omits is how you actually stand it up, the deployment guardrails, and the gated Expert tier.

How to run it

Base install, no API key, fully offline:

pip install -r requirements.txt
python app.py
# open http://127.0.0.1:5000

Or Docker (served by gunicorn, single worker so the in-memory scoreboard stays consistent):

docker compose up --build
# or:
docker build -t llmvault .
docker run -p 5000:5000 llmvault

Live Mode is optional and additive — skip it and the other 25 labs still work offline:

# 1. install Ollama, confirm it's serving
curl http://localhost:11434/api/tags
# 2. pull the model (~2 GB, CPU only)
ollama pull qwen2.5:3b-instruct
# 3. start LLMVault; the Live Zone connects on its own
python app.py

Ollama running elsewhere → set OLLAMA_HOST. An OpenAI-compatible endpoint works instead via OPENAI_API_KEY (otherwise nothing calls a hosted API). Expect a few seconds per reply on CPU. Full notes in docs/LIVE_MODE_SETUP.md.

Progress persists to data/progress.json (no database); in Docker the ./data volume survives down/up. Delete the file to reset all players.

The Expert tier is encrypted, not just locked

The five expert labs ship as ciphertext: challenges and flags are AES/Fernet-encrypted into challenges/expert.enc, keyed from an Expert Access Key held only in the operator's private vault. Cloning the repo yields ciphertext only. To unlock, a player must finish all Core + Advanced labs, then get the key handed out manually by the operator (CyberSunil) after sharing a completion card. A wrong key fails authenticated decryption and reveals nothing — so you cannot self-serve or dump the expert content by reading the repo.

Caveats

• Intentionally vulnerable — do not expose to the internet. For Docker, bind localhost explicitly: "127.0.0.1:5000:5000" in docker-compose.yml.
• Expert labs are simulated: the app recognises a known payload and returns a flag; no real RCE/SSRF/SQL executes.
• Play Mode assistants are scripted (deterministic, reproducible flags); flags are now verified by hash comparison rather than stored plaintext. Live Mode is a real local model, so a working payload one session may fail the next.