A home lab built for OWASP-aligned web testing:

• Deliberately vulnerable web apps (DVWA, Juice Shop) on a Host-Only network
• Kali Linux attacker VM with Burp Suite, ZAP, sqlmap, Nikto, Gobuster
• Documented attack paths for SQLi, XSS, CSRF, and auth flaws
• Findings written up with CVSS scores and remediation notes