Academy · Labs

The Lab Universe

Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.

14
labs
Difficulty
Category
Track
ApprenticeInformation disclosure

A backup file left in the web root

Find the secret the application leaks without meaning to.

10 pts · 20 minStart →
ApprenticeInformation disclosure

Comments in the source with a key in them

Find the secret the application leaks without meaning to.

10 pts · 20 minStart →
ApprenticeInformation disclosure

The stack trace that names the database

Find the secret the application leaks without meaning to.

10 pts · 20 minStart →
PractitionerSubdomain takeover

A CNAME pointing at a deleted bucket

Claim a dangling DNS record that points at an unclaimed host.

25 pts · 45 minStart →
PractitionerInformation disclosure

Secrets committed to an exposed .git

Find the secret the application leaks without meaning to.

25 pts · 45 minStart →
PractitionerInformation disclosure

The debug endpoint still answering in production

Find the secret the application leaks without meaning to.

25 pts · 45 minStart →
PractitionerSubdomain takeover

The pages site that was never published

Claim a dangling DNS record that points at an unclaimed host.

25 pts · 45 minStart →
PractitionerInformation disclosure

User enumeration through timing

Find the secret the application leaks without meaning to.

25 pts · 45 minStart →
ExpertInformation disclosure

An API version that forgot to retire

Find the secret the application leaks without meaning to.

50 pts · 90 minStart →
ExpertSubdomain takeover

An expired CDN configuration still referenced

Claim a dangling DNS record that points at an unclaimed host.

50 pts · 90 minStart →
ExpertInformation disclosure

GraphQL introspection left switched on

Find the secret the application leaks without meaning to.

50 pts · 90 minStart →
ExpertInformation disclosure

Metadata in an uploaded file's response

Find the secret the application leaks without meaning to.

50 pts · 90 minStart →
ExpertSubdomain takeover

The cancelled SaaS that left a dangling record

Claim a dangling DNS record that points at an unclaimed host.

50 pts · 90 minStart →
MasterSubdomain takeover

Chaining a takeover into cookie theft

Claim a dangling DNS record that points at an unclaimed host.

100 pts · 180 minStart →