madnessbrainsbl/ROOT
RØOT — offline-first AppSec training with OWASP labs, browser CTFs, remediation guides, security tools, and a reproducible CVE catalog built from public sources. - madnessbrainsbl/ROOT
0 stars · 0 forks · 0 watchers
README
RØOT Break it safely. Fix it properly. An offline-first AppSec workspace for OWASP practice, remediation, verification, and CVE prioritization. Live demo · Open app
⚡ Quick start · 🧭 Navigation guide · 📊 Framework comparison · 📦 Included content · 🛡️ Responsible use · 🤝 Contributing
What is RØOT? RØOT turns a security topic into a repeatable workflow: understand the trust boundary, reproduce the flaw in a controlled browser simulation, compare the remediation, and verify the lesson with a quiz. It runs locally with no SaaS account, API key, analytics service, or live target. Built for developers learning AppSec, teams validating controls, and educators running offline labs.
⚡ Quick start Requirements: Python 3.10+ and a modern browser. git clone https://github.com/madnessbrainsbl/ROOT.git cd ROOT python3 serve.py # Windows: python serve.py Open http://127.0.0.1:8080/ for the landing page or http://127.0.0.1:8080/app/ for the workspace. Docker docker compose up --build The container needs no credentials and keeps its generated SQLite database in a temporary writable filesystem.
🧭 Navigation guide
I want to… Open
Practice a web vulnerability OWASP Web Top 10
Test an API risk OWASP API Security Top 10
Turn a requirement into evidence ASVS
Plan testing or threat modelling Security frameworks
Prioritize a public vulnerability Zero-Days / KEV
Find a security tool or command Tools and Commands
Document an authorized assessment Report templates
📊 Framework comparison Choose the method by the question it answers:
Framework Best for RØOT route
OWASP Top 10 Prioritizing common web risks Web Top 10
OWASP API Security Top 10 API authorization, authentication, and abuse cases API Top 10
OWASP ASVS Verifiable application-security requirements ASVS
OWASP WSTG A repeatable web-testing method WSTG
OWASP SAMM AppSec-program maturity SAMM
STRIDE / PASTA / LINDDUN Threat modelling and abuse paths Threat modelling
NIST SSDF / SLSA / SBOM Secure delivery and supply chain Secure SDLC
CVSS / EPSS / KEV / SSVC Vulnerability prioritization Vulnerability lifecycle
Quick decision guide:
Need to learn or demonstrate a flaw → start with Web or API Top 10. Need an acceptance criterion → use ASVS. Need a testing plan → use WSTG or the lifecycle map. Need to decide what to fix first → combine KEV, EPSS, exploitability, and asset context.
📦 Included content
Content Count
Web CTF challenges 30
OWASP API Security mini-labs 10
Bilingual quiz questions 500
Public CISA KEV records 250
Security tool references 420
Security standards and methods 50
Payload examples in 66 categories 1,224
Attack-chain scenarios 114
Command builders 59
Offline CVE data RØOT bundles a deliberately small public CISA KEV and CVE List V5 snapshot. It never downloads data at startup. The browser uses the tracked JSON seed; the Python server indexes it in SQLite.
Provenance and SHA-256: data/cves_public.provenance.json Rebuild the public seed: python scripts/build_cve_seed.py --limit 250 Set ROOT_CVE_MODE=public to force the tracked public dataset locally.
Architecture Browser (vanilla JavaScript) ├── OWASP Web / API / LLM / ASVS workspace ├── CTF simulations, quizzes, tools, payloads, chains, and reports ├── sql.js knowledge workspace + local browser progress └── GET /api/cves → Python standard-library server → SQLite
The runtime uses no third-party Python package and no frontend framework. 🛡️ Responsible use RØOT is for education and systems you own or are explicitly authorized to assess. Do not use its examples, payloads, simulations, or command references to access, disrupt, alter, or extract data from another system. The CVE snapshot is a study aid, not live threat intelligence; confirm material decisions against the primary vendor advisory and the referenced CVE or CISA entry. 🤝 Contributing Keep changes focused, avoid new production dependencies without agreement, and include the smallest relevant test. Content must cite compatible sources and licenses. Do not submit secrets, personal data, proprietary material, or live target data. Third-party licenses Bundled material retains its own terms where applicable: sql.js (MIT), PayloadsAllTheThings (MIT), OWASP ASVS (CC BY-SA 4.0), locally hosted fonts (SIL OFL), CISA KEV, and CVE List V5. Full license texts are in licenses/.