The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
4
labsDifficulty
Category
MasterAuthentication bypass
Forging the 'already verified' state
Get past the login without the credential it is supposed to demand.
100 pts · 180 minStart →
MasterCSRF
Login CSRF into an attacker's account
Make a logged-in victim's browser send a state-changing request.
100 pts · 180 minStart →
MasterCross-site scripting (XSS)
Mutation XSS the sanitiser did not expect
Get your script to run in another visitor's browser on this origin.
100 pts · 180 minStart →
MasterCross-site scripting (XSS)
Stealing a session under a weak CSP
Get your script to run in another visitor's browser on this origin.
100 pts · 180 minStart →