Academy · Labs

The Lab Universe

Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.

10
labs
Difficulty
Category
Track
ApprenticeBroken access control / IDOR

Reading another user's support tickets

Reach an object that was never yours by changing the id that names it.

10 pts · 20 minStart →
ApprenticeBroken access control / IDOR

The invoice with your neighbour's name on it

Reach an object that was never yours by changing the id that names it.

10 pts · 20 minStart →
ApprenticeBroken access control / IDOR

The order history one id away

Reach an object that was never yours by changing the id that names it.

10 pts · 20 minStart →
PractitionerBroken access control / IDOR

Deleting a comment you did not write

Reach an object that was never yours by changing the id that names it.

25 pts · 45 minStart →
PractitionerBroken access control / IDOR

Editing a profile that is not yours

Reach an object that was never yours by changing the id that names it.

25 pts · 45 minStart →
PractitionerBroken access control / IDOR

The export endpoint that forgot to ask who is asking

Reach an object that was never yours by changing the id that names it.

25 pts · 45 minStart →
ExpertBroken access control / IDOR

A GUID is not an authorization check

Reach an object that was never yours by changing the id that names it.

50 pts · 90 minStart →
ExpertBroken access control / IDOR

Mass-assigning your way into an admin group

Reach an object that was never yours by changing the id that names it.

50 pts · 90 minStart →
ExpertBroken access control / IDOR

The nested resource that skipped its parent's check

Reach an object that was never yours by changing the id that names it.

50 pts · 90 minStart →
MasterBroken access control / IDOR

Chaining two objects into a full account read

Reach an object that was never yours by changing the id that names it.

100 pts · 180 minStart →