Transparency · Accountability · Compliance
EVIL site policies
EVIL is a platform for study, simulation and defence in cybersecurity. Accessing and using the tools means accepting the rules described here. If you are unsure about an activity, do not proceed without written authorisation from the owner of the systems.
Last updated: June 2026 · Version 1.0
1. Mission and purpose
EVIL (Educational Vulnerability & Intelligence Lab) offers learning content, quizzes, virtual labs, maps of incidents from public sources and analysis tools aimed at understanding threats and defending against them.
It does not promote, facilitate or tolerate offensive activity against systems, networks or people without a legal basis and explicit authorisation. The techniques shown are there to train professionals, SOC teams and students within ethical and legal boundaries.
2. Permitted use
You may use EVIL for:
- Personal learning, or cybersecurity training in academic and corporate settings.
- Exercises in the platform's virtual labs and simulators, designed as isolated learning environments.
- Analysing URLs, HTTP headers, DNS or files that you own or that the owner has given you a written mandate for.
- Consulting intelligence from public sources (CVEs, incident feeds, historical datasets) in line with the sources' licences.
- Preparing for certifications and internal quizzes, without sharing credentials or bypassing other people's access controls.
3. Forbidden use
It is expressly forbidden to:
- Attack, aggressively scan or compromise systems, networks or accounts without written authorisation.
- Use knowledge or tools acquired on EVIL for fraud, extortion, stalking, defamation or any other offence.
- Distribute malware, exploits working against third parties or material that infringes third-party rights.
- Circumvent rate limits, authentication or security measures of the platform or of external services.
- Collect third parties' personal data (including through OSINT) in breach of the GDPR, privacy law or the terms of the services consulted.
- Present simulated or sample data as real evidence in legal, commercial or journalistic contexts without saying so.
4. Penetration tests and assessments of real systems
Any security assessment, intrusive vulnerability scan or penetration test on real infrastructure requires written authorisation from the client or owner, with a defined scope, timing and techniques.
Before starting a real test, document at least:
- A signed authorisation letter or contract.
- The scope (IPs, domains, applications, exclusions).
- Time windows and emergency contacts.
- Permitted and forbidden techniques (e.g. denial of service, social engineering against employees).
- Rules on sensitive data, retention and destruction of dumps.
5. Simulations, sample data and labs
Many sections of EVIL use simulated data, mock-ups or teaching scenarios (lab 10.42.x.x, quizzes, training timelines, descriptive malware catalogues). Badges and notices on the page show when content does not represent a live incident or an active threat.
| Type | Meaning |
|---|---|
| Simulated / Lab | Controlled environment; no impact on public networks. |
| Mock / Demo | Sample data to illustrate concepts. |
| Public sources | CVEs, open feeds or datasets; always check the original source. |
6. Analysis tools and OSINT
URL check, DNS enumeration, header analysis, domain reconnaissance and the OSINT modules are designed for defensive assessment and research, not for unauthorised offensive reconnaissance.
- Respect the targets' terms of service and the applicable laws (Italy, the EU and the owner's jurisdiction).
- Do not use the platform to overload other people's services (rate limits and fair use).
- Do not upload files containing real malware aimed at third parties; local file analysis uses the browser whenever possible.
- The results are indicative: they do not replace professional audits or legal advice.
7. Accounts, privacy and data
Signing up may require an email address and the profile data needed for the service (authentication, progress, password recovery). Data is processed to run the platform and is not sold to third parties for marketing.
Principles we apply
- Minimisation: we collect only what the service needs to work.
- Security: hashed passwords, tokens in httpOnly cookies where applicable, HTTPS in production.
- Data subject rights: you can request correction or deletion of your account as described on the platform.
- Technical logs: kept for security and diagnostics for limited periods.
In local development the data may live in files on your computer (users.json); it is not automatically synchronised with the production instance.
8. Legal compliance and intellectual property
Users are responsible for complying with the national and international laws that apply to their role and territory. The platform's content, trademarks and software remain the property of their respective owners; unauthorised commercial reproduction is forbidden.
Links to external resources (CVEs, GitHub, incident feeds) do not imply endorsement; always check the licences and attributions of the sources cited.
9. Limitation of liability
EVIL is provided "as is", for training purposes. We do not guarantee that the content is error-free, that automated analyses are complete or that they are fit for operational, contractual or legal decisions.
The platform's operators are not liable for damage resulting from misuse, breaches of these policies or failure to check authorisation on third-party systems.
10. Changes to the policies
These policies may be updated to reflect new tools, legal requirements or security improvements. The date at the top shows the last significant revision. Continuing to use the site after changes are published means accepting the current version.
By using EVIL you confirm that you have read these policies and commit to ethical, defensive and lawful use.