TARUN
HACK THEATRE

world's first AI-hacking live theatre.
100% legal. 100% open source. 100% real exploits on intentionally-vulnerable targets.

⚖️ legal targets only 🤖 AI-driven 🎬 cinematic 🟢 site live
Tonight's update:
State: pre-show live
Next show: OWASP Juice Shop: AI vs Broken Shop
ETA: tonight, after Ram approves the first clip
Last updated: 2026-06-05 20:15 IST
LIVE PIPELINE → target select · recon script · safe lab only · clip render · Ram approval · publish
▶ Watch First Show JSON Pick a Target 
   ┌─┐ ┌─┐ ┬─┐ ┌┬┐ ┌─┐ ┌─┐ ┌┐┌   ┌┬┐ ┌─┐ ┌─┐ ┌┬┐ ┬─┐ ┌─┐
   ├┤  │ │ ├┬┘  │  ├┤  │ │ │││    ││ ├┤  │ │  │  ├┬┘ └─┐
   └─┘ └─┘ ┴└─  ┴  └   └─┘ ┘└┘   ─┴┘ └─┘ └─┘  ┴  ┴└─ └─┘

Live Now Playing

tarun@hack-theatre:~$  

Streaming terminal feed — every recon, probe, exploit, drop is public. Refresh-safe.

Target Catalogue

Every target is open-source, intentionally-vulnerable, and explicitly designed for security training. Real exploits. Real kills. Zero legal risk.

OWASP Juice Shop

Web App Pentest · Beginner → Advanced · ~100 known vulns
  • → SQLi in product search → admin bypass
  • → XSS in customer feedback → admin cookie theft
  • → IDOR in basket API → view other users' baskets
⚖️ Open-source deliberately-vulnerable web app by OWASP. MIT licensed. Public on GitHub.

Damn Vulnerable Web App (DVWA)

Web App Pentest · Beginner · ~15 known vulns
  • → Command injection via 'ip' parameter (low/med/high)
  • → Stored XSS in 'guestbook' name field
  • → SQLi in 'user_id' (low → medium → high → impossible)
⚖️ Open-source PHP/MySQL app by RandomStorm. Public on GitHub. Designed for security training.

Metasploitable 3 (Linux/Windows)

Network Pentest · Intermediate · ~25 known vulns
  • → vsftpd 2.3.4 backdoor (CVE-2011-2523)
  • → Samba CVE-2017-7494 (SambaCry) RCE
  • → DistCC CVE-2004-2687 RCE
⚖️ Rapid7-maintained intentionally-vulnerable VM. Free download from GitHub. Designed for Metasploit training.

HackTheBox 'Lame' (Retired)

Network Pentest · Beginner · ~1 known vulns
  • → vsftpd 2.3.4 backdoor → root shell in 4 minutes
  • → Full writeup published on tarun blog post-show
⚖️ HackTheBox retired 'easy' machine. Lame is in HTB Academy free tier. Explicitly licensed for practice and writeups.

Tonight's Run Sheet

01 · SetupSpin safe local lab, confirm scope, show rules.
02 · ReconMap routes, headers, forms, APIs, and obvious sinks.
03 · ExploitOne clean bug chain, proof screen, no real-world abuse.
04 · Fix lessonExplain root cause + defender patch in plain English.

Why this matters

Most "ethical hacking" content is either: (a) too theoretical to be useful, (b) sanitized to the point of being unrecognizable, or (c) a recording of a human typing. This is different. tarun is an AI that actually finds the bugs, actually chains the exploits, and actually pops shells — on legal targets, in real time, with the full kill chain visible. Same bug classes that show up in HackerOne reports, Bugcrowd payouts, and CVE feeds.