LingJing is a desktop cyber range that boots vulnerable VMs locally with QEMU

A local range where the target machines and the network both arrive preconfigured

LingJing is described as a desktop-class local cyber range platform built for penetration testing in complex network environments. The two properties that define it are in that sentence. It is local, so the range runs on your own machine rather than on someone else's server, and it is a platform rather than a collection of virtual machines, so the network around the targets is set up for you.

The README describes it as supporting online download and configuration-free one-click deployment of target environments, with built-in routing management and monitoring of the traffic you generate while testing. A single target starts in 5 to 30 seconds, with domain environments slower because domain members and domain controllers need time to establish communication with each other. The README is candid that the actual figure depends on the performance of the physical machine.

That last point is the one to hold onto when evaluating. Startup time here is a function of your laptop, not of the platform, and a range that starts fast on a workstation can be slow on a thin client.

The network control is the feature that makes this useful rather than merely convenient. The README states that target machine communication is strictly controlled by the platform's internal routing and that outbound internet access is forbidden. For a training environment this matters more than it might seem, because a vulnerable target that is deliberately easy to compromise is exactly the kind of process that should not be able to reach anything else on your network.

The GUI is built with Go and Fyne over QEMU virtualisation, and the platform supports cross-architecture targets. The most striking capability in that list is that it can start AMD64 architecture targets on a Mac M-series chip, which is what makes the tool usable on current Apple hardware without giving up the wider catalogue of Linux targets.

The target catalogue spans web flaws, domain environments and red team tradecraft

The catalogue is the other half of what the platform is for, and the README groups it by technical direction.

Web security testing covers SQL injection including blind, error-based and union-based variants, cross-site scripting, file upload vulnerabilities, CSRF, command execution and information disclosure. Internal network and domain environment attacks cover multi-layer network and domain controller deployments, suited to lateral movement, privilege escalation, Kerberos ticket abuse, NTLM relay and domain trust attacks. Middleware and framework vulnerability reproduction names Apache, Nginx, Tomcat, Struts2 and Spring. Java application security covers Java web vulnerabilities, deserialization chain analysis and security coding mistakes. Business logic and client security covers authentication bypass, permission control flaws and weak cryptography. Red team drills cover multi-hop communication, port forwarding, proxy chains and tunnelling.

The list is not the author's own work, and the README says so. It integrates existing open source range projects, and the acknowledgements name them: the Vulntarget series, VulnStack, VulnNyx, VulnHub, vulhub, DVGA, DVWA, JavaSecLab, WebGoat, Pikachu, SQLi-Labs, Upload-Labs and xss-labs. Original targets are described as coming later.

That has an obvious effect on the platform's character. It is a launcher and a network for a body of existing training material rather than a new body of vulnerable software, and that is a reasonable division of labour. The projects it integrates are individually auditable and widely deployed, so you can inspect what a target contains before you point a scanner at it.

The README also describes an experiment in progress: a 2D real time strategy game style mode that simulates the internet side and near-source penetration as a scenario. The wording is speculative and the phrasing acknowledges that support would make it possible to keep creating, so it reads as a direction rather than a shipped feature.

Getting it onto your machine, and the documentation that is actually available

There is a point here that needs stating plainly before the installation details, because it changes what this repository is.

The README notes that because the platform involves downloading target machine images from both the user's side and the cloud side, and to protect security on both ends, the project code is temporarily not open source. The implementation can be discussed in a desensitised form on request. The repository itself confirms this in practice: the only file at the top level is README.md, the primary language is not detected, and no licence is set.

So what you get is a binary release and a set of instructions, not a codebase. The listed releases are 0.4.6 from 2026-03-03, 0.4.7 from 2026-03-04 and 0.4.8 from 2026-03-20, and the last push to the repository was on 2026-06-02.

The installation instructions are not in the repository either. They live in linked articles on the project's WeChat public account, with separate ones for Mac installation and for Windows installation, and further ones for importing externally adapted targets and for linking external virtual machine software. The README links all four.

That documentation split is a genuine limitation for anyone outside the Chinese-language ecosystem, since the tutorials are behind a platform that may be awkward to reach, and the repository itself does not reproduce the steps. The README points at a CSDN blog article for the list of deployed target environments, which is the closest thing to a catalogue index.

The platform requirements are stated in the repository, at least. macOS on Arm64 is supported for M-series Macs including the Mini. Windows on Amd64 is adapted for Windows 10 and 11 in Home, Pro and English editions, and Windows 7 and below are no longer supported. Linux on Amd64 has been tested on Ubuntu 24.04.

Privileges, the virtual adapter, and the Windows networking trap

The platform needs elevated rights on both supported desktop systems, and the reasons differ.

On a Mac physical machine, administrator authorisation is required every time the platform runs, because the routing is bridged to the physical network interface. On Windows, administrator authorisation is needed only when the platform installs or removes the network adapter.

That Windows behaviour is the interesting one, because it is scoped. The platform uses a virtual network adapter, and the troubleshooting section addresses a specific failure: if you can ping a target started by LingJing but cannot reach any of its services, with HTTP and SSH ports unresponsive, the first thing to check is whether the LingJing virtual adapter has obtained a valid IP address in the same subnet as the platform's built-in routing. If it has not, you configure a static IP on the LingJing virtual adapter manually, in the same subnet as the virtual adapter's own IP, with no gateway and no DNS required.

The README attributes this class of problem to the wide variation in Windows network configurations across users' machines. That is a fair characterisation and a useful warning, because it means the platform's networking is not entirely under its own control on Windows, and the failure mode is a silent one where the range appears to start but nothing is reachable.

Two other operational notes are worth carrying. If the platform exits because of a bug, the background processes must be cleaned up manually, because if they are left running the next launch will fail, with the routing not working or targets refusing to start, and the recovery is to end the processes and then restart the routing through the platform or restart the platform. And there is a documented error message about the driver not appearing to support OpenGL, with a separate solution article linked for it.

Both of these are the cost of a desktop GUI application that owns a virtual network on your host.

What the platform does not give you, and how the alternatives differ

There are two limits that are worth being direct about, and one alternative worth understanding on its own terms.

The first limit is the closed code. There is no source to read, no licence to check, and no way to audit the routing logic that sits between your physical network and the targets. For a tool whose entire purpose involves running deliberately vulnerable software on your machine, that is a category of trust that has to be granted rather than verified.

The second limit is the dependence on hosted image downloads. The platform is a client for a cloud distribution service, with multi-node deployment and resumable downloads for the target images. That is what makes one-click deployment possible, and it is also the reason the code is closed and the reason the platform needs an account and a cloud service at runtime rather than being a self-contained bundle.

The alternatives differ in approach rather than in degree. VulnHub and the Vulntarget series distribute virtual machine images directly, so you download an archive, import it into VirtualBox or VMware yourself, and configure the network by hand, which is slow to set up and gives you full visibility and control over the images and the network. Docker based vulnerable images give you a similar isolation story with a much lighter footprint and no virtualisation, but they cover web application flaws well and cover full domain environments poorly. Building your own network out of plain QEMU and Vagrant gives the same control as VulnHub with far more setup work, and it is what this platform is automating.

LingJing's contribution is the automation of the middle ground: a catalogue, a routing layer, and a one-click start for machines that need real network topology rather than a single container. The trade is that the images, the routing and the platform all come from a single source that you cannot inspect.

Editorial conclusion

Adopt LingJing if you want practice target machines that start in seconds on a Mac or Windows laptop and are already wired into an isolated internal network, since the routing and the no-outbound rule are handled for you and the platform bundles a long list of well known open source ranges. Do not adopt it expecting an inspectable open source platform, because the repository contains only a README, the licence field is not set, and the project states its code is temporarily closed to protect the image download path. Before you rely on it, check the platform requirements table, since Windows 7 and below are unsupported and only Ubuntu 24.04 has been tested on Linux, and confirm that your physical machine can host QEMU virtualisation and accept the administrator prompt that bridges the platform routing to your real network interface. The last push was on 2026-06-02 and the latest listed release is 0.4.8 from 2026-03-20.

Frequently asked questions

Official sources

1. 414aaj/LingJing on GitHub
2. Issues
3. README
4. Releases