Why it is worth attention

It delivers a genuine Linux virtual machine entirely in the browser without any backend servers, using a custom-tiny kernel and WebAssembly, enabling fully static hosting and instant reset—an ideal zero-setup environment for security education.

Who it is for

Absolute beginners with zero Linux or security experience
University/college cybersecurity clubs seeking an immersive onboarding tool
Self-learners who want a practical, risk-free Linux security playground
Educators looking for an open-source, audit-ready lab for classroom use

Use cases

Teaching fundamental Linux commands and file system navigation interactively
Practicing security skills like log analysis, privilege escalation awareness, and configuration hardening in a sandboxed VM
Running CTF-style challenges without any local or cloud setup
Onboarding new members to a security team with a structured, guided learning path

Strengths

Real Linux kernel (32-bit) running via v86 WebAssembly, not a command simulator—commands behave authentically
Completely static frontend + VM assets (~7MB), deployable on any static host (GitHub Pages, Nginx, object storage)
Two modes (guided/challenge) share the same environment and outcome-based grading, with all logic inside the VM
Fully open-source (BSD-2-Clause v86, GPL Linux/BusyBox) and customizable—add new levels by dropping a directory

Considerations

v86 software virtualization is slower than native; heavy computation tasks are impractical (but the intended exercises are unaffected)
No snapshot save/restore yet—level reset works by rebooting the entire VM (planned for future)
Some tools are simplified (curl based on wget, file is a magic-number script; no Python 3 or objdump) to keep image small

README quick start

HASHTEAM Security Lab · 安全新手村

一个完全运行在浏览器里的交互式 Linux 安全入门实验平台，面向零基础新生：打开网页就能获得一个真实的 Linux 终端，跟着任务卡完成 10 个精心设计的安全入门实验——从认识 Shell、文件整理，到日志分析、编码还原、进程排查、Web 信息泄露和配置修复。

整个环境基于 WebAssembly 在本地虚拟化运行，不依赖任何后端容器；刷新页面或点击「重新开始」即可恢复原样。

1. 项目简介

浏览器内启动一个真实（非模拟）的 32 位 Linux：自构建精简内核 + BusyBox 用户态。
使用 xterm.js 作为终端，v86（WebAssembly x86 虚拟机）作为运行时。
10 个零基础关卡，每关 2–8 分钟：初次登录 / 隐藏文件 / 搬家整理 / 权限加固 / 日志分析（计数 + 追踪） / 编码取证 / 进程排查 / 本地 Web 服务 / 配置修复。
首次进入可明确选择引导模式或挑战模式：引导模式每次只展示一个动作，挑战模式隐藏分步答案；两种模式共用同一套真实环境与最终状态判题。
虚拟机内的检查脚本通过串口协议（@@HASHTEAM:{...}）与前端通信，前端据此更新任务面板、提示系统和进度存档（LocalStorage）。
传达的理念：CTF 是入门手段，不是终点——结束页展示实验室在漏洞挖掘、渗透攻防、安全开发、校园安全运维四个方向的真实工作。

2. 架构说明

┌────────────────────────────── 浏览器（纯静态页面）──────────────────────────────┐
│  Vue 3 应用                                                                    │
│  ├─ TopBar / MissionPanel / CompletionPage   （任务文案来自每关 challenge.json）│
│  ├─ LabTerminal (xterm.js) ◄── 显示文本                                       │
│  │                              ▲                                            │
│  ├─ useSerialProtocol           │  SerialProtocolParser：按行拆分，           │
│  │     串口字节流 ──────────────┴─► 普通输出 → 终端；@@HASHTEAM 行 → 消息     │
│  ├─ useVirtualMachine / V86Controller（对 v86 API 的唯一封装）                │
│  └─ useLabProgress（LocalStorage 持久化）                                     │
│                                                                               │
│  v86 (WebAssembly)                                                            │
│  └─ 32 位 Linux：定制内核 bzImage + initramfs（BusyBox + 关卡系统）           │
│       ├─ 自动登录 guest@hashteam（cttyhack + su）                             │
│       ├─ /usr/local/bin：check / hint / status / help / reset-level /         │
│       │   hashteamctl / curl(兼容层) / file(简化实现)                          │
│       └─ /opt/hashteam/levels/level-N/{challenge.json, init.sh, check.sh, ...}│
│            串口输出 @@HASHTEAM:{"type":"level-result","level":3,...}          │
└───────────────────────────────────────────────────────────────────────────────┘

关键设计：

判题在虚拟机内完成：每关的 check.sh 校验的是结果状态（答案、日志统计结论、配置文件最终内容），而不是「用户敲过哪条命令」。
前端只信协议，不信输入：关卡完成状态来自 level-result 协议消息，前端从不通过监听键盘输入判题。
无网卡 = 天然断网：内核不编译任何网卡驱动，v86 也不配置网络设备，虚拟机只能访问自己的 127.0.0.1。
内存环境 = 免快照还原：rootfs 是 initramfs（内存文件系统），整机重启即回到初始状态；「重置本关」通过

Related repositories

Similar projects matched by category, topics, and programming language.

TanStack

Featured

router

TanStack Router is a type-safe, data-driven React router with built-in caching, prefetching, and nested layouts, while TanStack Start extends it into a full-stack SSR framework.

Web DevelopmentFrontend Frameworks

14,861

vercel-labs

Featured

scriptc

scriptc compiles ordinary TypeScript into small, fast native executables without needing Node.js, V8, or any JavaScript runtime in the binary.

Developer ToolsCode Quality & Build

1,985

Jakubantalik

Featured

thinking-orbs

A React component library that renders six hand-tuned animated thought orb loading indicators on a plain 2D canvas, with two purpose-tuned sizes and automatic theme detection for AI and agent UIs.

AI & Machine LearningAI Agents

1,191