The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
6
labsDifficulty
Category
PractitionerInsecure deserialization
A serialized cart the client can edit
Feed the server a serialized object it will trust and rebuild.
25 pts · 45 minStart →
PractitionerInsecure deserialization
The role hidden in a base64 cookie
Feed the server a serialized object it will trust and rebuild.
25 pts · 45 minStart →
ExpertInsecure deserialization
Tampering with a signed-but-unverified token
Feed the server a serialized object it will trust and rebuild.
50 pts · 90 minStart →
ExpertInsecure deserialization
Type confusion in a rebuilt object
Feed the server a serialized object it will trust and rebuild.
50 pts · 90 minStart →
MasterInsecure deserialization
A gadget chain to state change
Feed the server a serialized object it will trust and rebuild.
100 pts · 180 minStart →
MasterInsecure deserialization
From deserialization to file write
Feed the server a serialized object it will trust and rebuild.
100 pts · 180 minStart →