The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
A file type check you can talk past
Turn a foothold into commands running on the server itself.
A GUID is not an authorization check
Reach an object that was never yours by changing the id that names it.
A length-extension against a naive MAC
Break the guarantee a weak or misused primitive was meant to give.
A password reset that trusts the wrong field
Get past the login without the credential it is supposed to demand.
An admin route that never re-checks
Climb from the access you were given to access you were not.
An API version that forgot to retire
Find the secret the application leaks without meaning to.
An expired CDN configuration still referenced
Claim a dangling DNS record that points at an unclaimed host.
An invite flow that leaks a higher role
Climb from the access you were given to access you were not.
An OAuth state parameter nobody validates
Get past the login without the credential it is supposed to demand.
An upload that lands in an executable path
Turn a foothold into commands running on the server itself.
Applying two coupons in the same instant
Slip through the window between a check and the action it guards.
Approving your own request as its reviewer
Climb from the access you were given to access you were not.
Beating a rate limit with concurrency
Slip through the window between a check and the action it guards.
Blind SSRF confirmed out of band
Make the server fetch a URL of your choosing, from inside its network.
Boolean-blind, one bit at a time
Break out of a query or a shell command through unescaped input.
Bypassing an allowlist with a DNS trick
Make the server fetch a URL of your choosing, from inside its network.
Defeating a predictable token
Make a logged-in victim's browser send a state-changing request.
DOM XSS through the URL fragment
Get your script to run in another visitor's browser on this origin.
GraphQL introspection left switched on
Find the secret the application leaks without meaning to.
Injecting into a JSON block the page evaluates
Get your script to run in another visitor's browser on this origin.
Mass-assigning your way into an admin group
Reach an object that was never yours by changing the id that names it.
Metadata in an uploaded file's response
Find the secret the application leaks without meaning to.
Reaching the cloud metadata endpoint
Make the server fetch a URL of your choosing, from inside its network.
Referral rewards that pay you to invite yourself
Use the feature exactly as built, in an order it never anticipated.
Reusing a magic link that never expired
Get past the login without the credential it is supposed to demand.
SameSite is not set, and it matters
Make a logged-in victim's browser send a state-changing request.
Second-order injection through a stored value
Break out of a query or a shell command through unescaped input.
Skipping the payment step of the order
Use the feature exactly as built, in an order it never anticipated.
Slipping past a naive filter
Get your script to run in another visitor's browser on this origin.
Swapping a JWT to the 'none' algorithm
Break the guarantee a weak or misused primitive was meant to give.
Tampering with a signed-but-unverified token
Feed the server a serialized object it will trust and rebuild.
The cancelled SaaS that left a dangling record
Claim a dangling DNS record that points at an unclaimed host.
The JWT signed with a guessable secret
Break the guarantee a weak or misused primitive was meant to give.
The nested resource that skipped its parent's check
Reach an object that was never yours by changing the id that names it.
Time-based extraction from a silent endpoint
Break out of a query or a shell command through unescaped input.
Type confusion in a rebuilt object
Feed the server a serialized object it will trust and rebuild.
Upgrading a plan without paying the difference
Use the feature exactly as built, in an order it never anticipated.
Withdrawing a balance in parallel
Slip through the window between a check and the action it guards.