The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
5
labsDifficulty
Category
ApprenticeBusiness logic flaw
A negative quantity at checkout
Use the feature exactly as built, in an order it never anticipated.
10 pts · 20 minStart →
ApprenticeBusiness logic flaw
A price that travels in the request
Use the feature exactly as built, in an order it never anticipated.
10 pts · 20 minStart →
ApprenticeBroken access control / IDOR
Reading another user's support tickets
Reach an object that was never yours by changing the id that names it.
10 pts · 20 minStart →
ApprenticeBroken access control / IDOR
The invoice with your neighbour's name on it
Reach an object that was never yours by changing the id that names it.
10 pts · 20 minStart →
ApprenticeBroken access control / IDOR
The order history one id away
Reach an object that was never yours by changing the id that names it.
10 pts · 20 minStart →