The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
5
labsDifficulty
Category
PractitionerSubdomain takeover
A CNAME pointing at a deleted bucket
Claim a dangling DNS record that points at an unclaimed host.
25 pts · 45 minStart →
PractitionerSubdomain takeover
The pages site that was never published
Claim a dangling DNS record that points at an unclaimed host.
25 pts · 45 minStart →
ExpertSubdomain takeover
An expired CDN configuration still referenced
Claim a dangling DNS record that points at an unclaimed host.
50 pts · 90 minStart →
ExpertSubdomain takeover
The cancelled SaaS that left a dangling record
Claim a dangling DNS record that points at an unclaimed host.
50 pts · 90 minStart →
MasterSubdomain takeover
Chaining a takeover into cookie theft
Claim a dangling DNS record that points at an unclaimed host.
100 pts · 180 minStart →