The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
A GUID is not an authorization check
Reach an object that was never yours by changing the id that names it.
An admin route that never re-checks
Climb from the access you were given to access you were not.
An invite flow that leaks a higher role
Climb from the access you were given to access you were not.
Approving your own request as its reviewer
Climb from the access you were given to access you were not.
Mass-assigning your way into an admin group
Reach an object that was never yours by changing the id that names it.
Referral rewards that pay you to invite yourself
Use the feature exactly as built, in an order it never anticipated.
Skipping the payment step of the order
Use the feature exactly as built, in an order it never anticipated.
The nested resource that skipped its parent's check
Reach an object that was never yours by changing the id that names it.
Upgrading a plan without paying the difference
Use the feature exactly as built, in an order it never anticipated.