The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
A negative quantity at checkout
Use the feature exactly as built, in an order it never anticipated.
A price that travels in the request
Use the feature exactly as built, in an order it never anticipated.
Reading another user's support tickets
Reach an object that was never yours by changing the id that names it.
The invoice with your neighbour's name on it
Reach an object that was never yours by changing the id that names it.
The order history one id away
Reach an object that was never yours by changing the id that names it.
A hidden form value that grants admin
Climb from the access you were given to access you were not.
Applying the same coupon twice
Use the feature exactly as built, in an order it never anticipated.
Deleting a comment you did not write
Reach an object that was never yours by changing the id that names it.
Editing a profile that is not yours
Reach an object that was never yours by changing the id that names it.
The export endpoint that forgot to ask who is asking
Reach an object that was never yours by changing the id that names it.
The role field the client should not set
Climb from the access you were given to access you were not.
Voting more than once by replaying the request
Use the feature exactly as built, in an order it never anticipated.
A GUID is not an authorization check
Reach an object that was never yours by changing the id that names it.
An admin route that never re-checks
Climb from the access you were given to access you were not.
An invite flow that leaks a higher role
Climb from the access you were given to access you were not.
Approving your own request as its reviewer
Climb from the access you were given to access you were not.
Mass-assigning your way into an admin group
Reach an object that was never yours by changing the id that names it.
Referral rewards that pay you to invite yourself
Use the feature exactly as built, in an order it never anticipated.
Skipping the payment step of the order
Use the feature exactly as built, in an order it never anticipated.
The nested resource that skipped its parent's check
Reach an object that was never yours by changing the id that names it.
Upgrading a plan without paying the difference
Use the feature exactly as built, in an order it never anticipated.
A support-impersonation feature turned on yourself
Climb from the access you were given to access you were not.
Assembling a discount no single rule forbids
Use the feature exactly as built, in an order it never anticipated.
Chaining two objects into a full account read
Reach an object that was never yours by changing the id that names it.
Horizontal to vertical in two steps
Climb from the access you were given to access you were not.
Inheriting permissions through a group you joined
Climb from the access you were given to access you were not.
Refunding more than you paid
Use the feature exactly as built, in an order it never anticipated.