The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
3
labsDifficulty
Category
ApprenticeCSRF
Changing an email with a single GET
Make a logged-in victim's browser send a state-changing request.
10 pts · 20 minStart →
ApprenticeCross-site scripting (XSS)
Reflected in the search box
Get your script to run in another visitor's browser on this origin.
10 pts · 20 minStart →
ApprenticeCross-site scripting (XSS)
The error page that echoes your input
Get your script to run in another visitor's browser on this origin.
10 pts · 20 minStart →