The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
4
labsDifficulty
Category
PractitionerPrivilege escalation
A hidden form value that grants admin
Climb from the access you were given to access you were not.
25 pts · 45 minStart →
PractitionerAuthentication bypass
Skipping the second step of a two-step login
Get past the login without the credential it is supposed to demand.
25 pts · 45 minStart →
PractitionerAuthentication bypass
The remember-me cookie that means too much
Get past the login without the credential it is supposed to demand.
25 pts · 45 minStart →
PractitionerPrivilege escalation
The role field the client should not set
Climb from the access you were given to access you were not.
25 pts · 45 minStart →