The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
Reading another user's support tickets
Reach an object that was never yours by changing the id that names it.
The invoice with your neighbour's name on it
Reach an object that was never yours by changing the id that names it.
The order history one id away
Reach an object that was never yours by changing the id that names it.
Deleting a comment you did not write
Reach an object that was never yours by changing the id that names it.
Editing a profile that is not yours
Reach an object that was never yours by changing the id that names it.
The export endpoint that forgot to ask who is asking
Reach an object that was never yours by changing the id that names it.
A GUID is not an authorization check
Reach an object that was never yours by changing the id that names it.
Mass-assigning your way into an admin group
Reach an object that was never yours by changing the id that names it.
The nested resource that skipped its parent's check
Reach an object that was never yours by changing the id that names it.
Chaining two objects into a full account read
Reach an object that was never yours by changing the id that names it.