The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
6
labsDifficulty
Category
MasterPrivilege escalation
A support-impersonation feature turned on yourself
Climb from the access you were given to access you were not.
100 pts · 180 minStart →
MasterBusiness logic flaw
Assembling a discount no single rule forbids
Use the feature exactly as built, in an order it never anticipated.
100 pts · 180 minStart →
MasterBroken access control / IDOR
Chaining two objects into a full account read
Reach an object that was never yours by changing the id that names it.
100 pts · 180 minStart →
MasterPrivilege escalation
Horizontal to vertical in two steps
Climb from the access you were given to access you were not.
100 pts · 180 minStart →
MasterPrivilege escalation
Inheriting permissions through a group you joined
Climb from the access you were given to access you were not.
100 pts · 180 minStart →
MasterBusiness logic flaw
Refunding more than you paid
Use the feature exactly as built, in an order it never anticipated.
100 pts · 180 minStart →