The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
7
labsDifficulty
Category
PractitionerPrivilege escalation
A hidden form value that grants admin
Climb from the access you were given to access you were not.
25 pts · 45 minStart →
PractitionerBusiness logic flaw
Applying the same coupon twice
Use the feature exactly as built, in an order it never anticipated.
25 pts · 45 minStart →
PractitionerBroken access control / IDOR
Deleting a comment you did not write
Reach an object that was never yours by changing the id that names it.
25 pts · 45 minStart →
PractitionerBroken access control / IDOR
Editing a profile that is not yours
Reach an object that was never yours by changing the id that names it.
25 pts · 45 minStart →
PractitionerBroken access control / IDOR
The export endpoint that forgot to ask who is asking
Reach an object that was never yours by changing the id that names it.
25 pts · 45 minStart →
PractitionerPrivilege escalation
The role field the client should not set
Climb from the access you were given to access you were not.
25 pts · 45 minStart →
PractitionerBusiness logic flaw
Voting more than once by replaying the request
Use the feature exactly as built, in an order it never anticipated.
25 pts · 45 minStart →