Interactive Application Security Playground & Defense Simulator
Exploit vulnerable applications. Patch the source. Verify the fix.
All through one isolated, containerized security workflow.
🕵️ EXPLOIT → 💻 PATCH → 🤖 VERIFY
RedPatch is an interactive, containerized application security playground and defense simulator designed to bridge the gap between offensive penetration testing and defensive secure code remediation. Built with a lightweight FastAPI orchestration engine, RedPatch goes beyond traditional vulnerability discovery by guiding users through a complete three-step security lifecycle: Exploit, Patch, and Verify.
Users begin in Pentester Mode, analyzing attack surfaces and exploiting flaws such as SQL Injection or IDOR to capture flags. They then transition to Coder Mode, gaining direct real-time access to the application's source code within an isolated workspace to write and apply root-cause security fixes. Finally, an AI Security Layer—built on an extensible provider abstraction—evaluates the applied patch to verify whether the vulnerability has been completely resolved. By decoupling the host orchestration engine from external laboratory definitions through a declarative manifest system (manifest.json), RedPatch provides a modular, lightweight, and scalable environment for practical cybersecurity education.
Video Demo: Youtube
Most security training environments teach you to find a vulnerability.
RedPatch makes you go one step further:
Exploit it → understand it → fix it → verify the fix.
The platform combines offensive security practice with defensive code remediation inside disposable Docker-based environments.
No separate tools. No disconnected exercises. One continuous workflow.
Interact with an intentionally vulnerable application and investigate its attack surface. Find the vulnerability. Exploit the application. Capture the flag.
demo-pentester.mp4
The vulnerable application's source becomes available through the built-in workspace, allowing you to inspect and patch the underlying code. Inspect the vulnerable code. Patch it. Verify the remediation.
demo-coder.mp4
┌─────────────────────────────────────────────────────────────────┐
│ REDPATCH │
│ │
│ PENTESTER CODER AI AGENT │
│ ───────────── ───────── ────────── │
│ Find the flaw → Patch it → Verify it │
│ Exploit the app Modify code Analyze fix │
│ │
└─────────────────────────────────────────────────────────────────┘
Submit your remediation to the configured security analysis agent in coder mode.
The agent evaluates the patch and provides feedback on whether the vulnerability has actually been addressed.
RedPatch is built as a lightweight host orchestration engine rather than a collection of hardcoded labs.
flowchart LR
USER[👤 User]
UI[Web Interface]
ENGINE[FastAPI Host Engine]
MANAGER[Lab Manager]
DOCKER[Docker Service]
PROXY[Async HTTP Proxy]
AI[AI Service]
MANIFEST[Lab Manifest]
CONTAINERS[Isolated Lab Containers]
PROVIDER[LLM Provider]
USER --> UI
UI --> ENGINE
ENGINE --> MANAGER
ENGINE --> DOCKER
ENGINE --> PROXY
ENGINE --> AI
MANAGER --> MANIFEST
DOCKER --> CONTAINERS
AI --> PROVIDER
PROXY --> CONTAINERS
app/main.py is the central application entry point.
It coordinates the web interface, lab lifecycle, workspace operations and request routing.
app/services/module_manager/lab_manager.py handles the lab catalog and manifest.
The engine does not contain the implementation of every vulnerability lab.
Instead, it consumes metadata describing available laboratories.
app/services/container_services/ isolates Docker-specific lifecycle operations from the rest of the application.
app/services/ai/ provides the AI analysis layer and separates provider-specific logic from the host engine.
The labs are maintained separately from the RedPatch engine.
This repository contains the platform and orchestration layer.
The actual vulnerable applications and laboratory implementations live in:
The host engine discovers available laboratories through app/labs/manifest.json.
A simplified entry looks like:
{
"labs": {
"SQLi": {
"description": "SQL Injection",
"submodules": [
{
"id": "sqli-0",
"title": "SQL Injection - Authentication Bypass",
"category": "web",
"image_tag": "redpatch-lab/sqli-0:v1.0.0",
"port": 5000,
"dev_path": "./labs/sqli-0",
"download_url": "..."
}
]
}
}
}The manifest acts as the bridge between the RedPatch engine and the externally maintained RedPatch Labs ecosystem.
This separation keeps the platform modular:
redpatch
│
└── Host / Orchestration
│
└── manifest.json
│
▼
redpatch-labs
│
┌────────┼────────┐
▼ ▼ ▼
SQLi IDOR Command Injection
The engine manages how labs run.
The labs repository defines what the labs are.
When a laboratory starts, RedPatch handles the runtime lifecycle through Docker.
Manifest
│
▼
Lab Selection
│
▼
Container Creation
│
▼
Workspace Preparation
│
▼
Interactive Session
│
▼
Teardown
This gives each active laboratory its own containerized runtime while keeping the orchestration logic inside the host engine.
RedPatch is an educational security playground. Its isolation model should not be treated as a hardened production sandbox for arbitrary hostile workloads.
The AI service is intentionally separated behind a provider abstraction.
AI Agent
│
▼
Provider Interface
│
▼
Gemini Provider
This means the rest of RedPatch does not need to depend directly on provider-specific API implementations.
The current configuration primarily supports Google Gemini.
You can manage your AI credentials and platform settings through two methods:
Launch the application and click the Settings icon in the navbar to open the in-app management panel. This allows you to update your settings dynamically without restarting the server:
- LLM Provider (e.g.,
gemini) - API Key
- Model Selection (e.g.,
gemini-flash-lite-latest)
Alternatively, you can edit app/core/config.json directly:
{
"API_KEY": "your_gemini_api_key_here",
"LLM_PROVIDER": "gemini",
"MODEL": "gemini-flash-lite-latest"
}Or specify a custom configuration file path using environment variables:
CONFIG_JSON=app/core/config.jsondocker network create redpatch_net
docker volume create redpatch_lab_tmp
# Linux / macOS
docker run -d \
--name redpatch-app \
-p 8000:8000 \
-v /var/run/docker.sock:/var/run/docker.sock \
-v redpatch_lab_tmp:/app/labs/archives \
--network redpatch_net \
msalihberk/redpatch:latest
# Windows
docker run -d `
--name redpatch-app `
-p 8000:8000 `
-v //./pipe/docker_engine:/var/run/docker.sock `
-v redpatch_lab_tmp:/app/labs/archives `
--network redpatch_net `
msalihberk/redpatch:latestgit clone https://github.com/msalihberk/redpatch.git
cd redpatch
docker compose up -d --buildThen open:
- Python 3.10+
- Docker / Docker Desktop
- Git
git clone https://github.com/msalihberk/redpatch.git
cd redpatch
python -m venv .venvActivate:
# Linux / macOS
source .venv/bin/activate
# Windows
.venv\Scripts\activateInstall:
pip install -r requirements.txtRun:
uvicorn app.main:app --reload --port 8000redpatch/
├── app/
│ ├── main.py
│ │
│ ├── core/
│ │ ├── config.py
│ │ └── config.json
│ │
│ ├── labs/
│ │ └── manifest.json
│ │
│ ├── services/
│ │ ├── ai/
│ │ ├── container_services/
│ │ └── module_manager/
│ │
│ ├── static/
│ └── templates/
│
├── docker-compose.yaml
├── requirements.txt
├── CONTRIBUTING.md
├── SECURITY.md
└── LICENSE
The source tree follows the same separation as the runtime architecture:
Interface → Engine → Services → External Labs
- Containerized lab execution
- Pentester Mode
- Coder Mode
- Manifest-driven lab discovery
- Isolated workspaces
- AI-assisted verification
- Docker distribution
- More vulnerability categories
- Additional LLM providers
- Automated security regression testing
- Expanded lab ecosystem
RedPatch is designed to grow through both engine improvements and new security laboratories.
If you want to contribute:
- Improve the host engine
- Add infrastructure capabilities
- Create new labs in the
redpatch-labsrepository - Report bugs
- Suggest new security scenarios
Read the Contributing Guide before submitting a pull request.
Built with ❤️ as a Harvard CS50x Final Project by Mustafa Salih Berk.