OwnedBox: uma plataforma de ensino para segurança web ofensiva e defensiva

Abstract

The increasing complexity of digital systems and the rise of cyberattacks highlight the need for educational tools that help students and professionals understand vulnerabilities and security practices. This work presents the design and development of OwnedBox, an open-source web platform aimed at teaching offensive and defensive web security through controlled laboratories. The solution organizes content into practical modules covering recurring OWASP Top 10 vulnerabilities, such as SQL Injection, Cross-Site Scripting (XSS), and malicious file uploads, enabling users to safely explore realistic pentesting scenarios. The system implements custom authentication, on-demand laboratory provisioning, and token validation, along with a user progress panel. Each laboratory runs in an isolated Docker container into which a unique flag is injected through an environment variable; after exploiting the vulnerability and capturing the flag, the user submits the corresponding token, which is validated by the system and automatically records the module completion. The development followed agile methodologies (Scrum, Kanban, and MoSCoW) and employed technologies such as Laravel, Docker, and SQLite. Results indicate that the platform provides an effective educational environment for practical cybersecurity training, contributing to the qualification of professionals in the field.