The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
A backup file left in the web root
Find the secret the application leaks without meaning to.
Comments in the source with a key in them
Find the secret the application leaks without meaning to.
The stack trace that names the database
Find the secret the application leaks without meaning to.
A CNAME pointing at a deleted bucket
Claim a dangling DNS record that points at an unclaimed host.
Secrets committed to an exposed .git
Find the secret the application leaks without meaning to.
The debug endpoint still answering in production
Find the secret the application leaks without meaning to.
The pages site that was never published
Claim a dangling DNS record that points at an unclaimed host.
User enumeration through timing
Find the secret the application leaks without meaning to.
An API version that forgot to retire
Find the secret the application leaks without meaning to.
An expired CDN configuration still referenced
Claim a dangling DNS record that points at an unclaimed host.
GraphQL introspection left switched on
Find the secret the application leaks without meaning to.
Metadata in an uploaded file's response
Find the secret the application leaks without meaning to.
The cancelled SaaS that left a dangling record
Claim a dangling DNS record that points at an unclaimed host.
Chaining a takeover into cookie theft
Claim a dangling DNS record that points at an unclaimed host.