The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
6
labsDifficulty
Category
ExpertBroken access control / IDOR
A GUID is not an authorization check
Reach an object that was never yours by changing the id that names it.
50 pts · 90 minStart →
ExpertServer-side request forgery (SSRF)
Blind SSRF confirmed out of band
Make the server fetch a URL of your choosing, from inside its network.
50 pts · 90 minStart →
ExpertServer-side request forgery (SSRF)
Bypassing an allowlist with a DNS trick
Make the server fetch a URL of your choosing, from inside its network.
50 pts · 90 minStart →
ExpertBroken access control / IDOR
Mass-assigning your way into an admin group
Reach an object that was never yours by changing the id that names it.
50 pts · 90 minStart →
ExpertServer-side request forgery (SSRF)
Reaching the cloud metadata endpoint
Make the server fetch a URL of your choosing, from inside its network.
50 pts · 90 minStart →
ExpertBroken access control / IDOR
The nested resource that skipped its parent's check
Reach an object that was never yours by changing the id that names it.
50 pts · 90 minStart →