The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
A login that leaks which half was wrong
Get past the login without the credential it is supposed to demand.
The default credential nobody changed
Get past the login without the credential it is supposed to demand.
Skipping the second step of a two-step login
Get past the login without the credential it is supposed to demand.
The remember-me cookie that means too much
Get past the login without the credential it is supposed to demand.
A password reset that trusts the wrong field
Get past the login without the credential it is supposed to demand.
An OAuth state parameter nobody validates
Get past the login without the credential it is supposed to demand.
Reusing a magic link that never expired
Get past the login without the credential it is supposed to demand.
Forging the 'already verified' state
Get past the login without the credential it is supposed to demand.