Log4Shell vulnerable app: `ghcr.io/christophetd/log4shell-vulnerable-app` - SSRF Lab: `jeroenwillemsen/ssrf-lab` - Deserlab: `tyrantsec/deserlab` - OWASP WebGoat: Includes server-side vulnerability lessons