The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
A comment field that renders markdown too eagerly
Get your script to run in another visitor's browser on this origin.
A JSON endpoint that accepts form content-type
Make a logged-in victim's browser send a state-changing request.
Breaking out of an HTML attribute
Get your script to run in another visitor's browser on this origin.
Secrets committed to an exposed .git
Find the secret the application leaks without meaning to.
Skipping the second step of a two-step login
Get past the login without the credential it is supposed to demand.
Stored in a display name
Get your script to run in another visitor's browser on this origin.
The debug endpoint still answering in production
Find the secret the application leaks without meaning to.
The form with no anti-forgery token
Make a logged-in victim's browser send a state-changing request.
The remember-me cookie that means too much
Get past the login without the credential it is supposed to demand.
User enumeration through timing
Find the secret the application leaks without meaning to.