The Lab Universe
Hands-on exercises across every class of vulnerability. Read the brief, work it against your own target, and submit the flag. Points and your level are yours the moment you solve one — join the Academy to start tracking them.
A serialized cart the client can edit
Feed the server a serialized object it will trust and rebuild.
A webhook tester pointed at localhost
Make the server fetch a URL of your choosing, from inside its network.
An image importer aimed inward
Make the server fetch a URL of your choosing, from inside its network.
The link-preview that fetches anything
Make the server fetch a URL of your choosing, from inside its network.
The role hidden in a base64 cookie
Feed the server a serialized object it will trust and rebuild.
A file type check you can talk past
Turn a foothold into commands running on the server itself.
An upload that lands in an executable path
Turn a foothold into commands running on the server itself.
Blind SSRF confirmed out of band
Make the server fetch a URL of your choosing, from inside its network.
Bypassing an allowlist with a DNS trick
Make the server fetch a URL of your choosing, from inside its network.
Reaching the cloud metadata endpoint
Make the server fetch a URL of your choosing, from inside its network.
Tampering with a signed-but-unverified token
Feed the server a serialized object it will trust and rebuild.
Type confusion in a rebuilt object
Feed the server a serialized object it will trust and rebuild.
A dependency confusion package that runs on install
Turn a foothold into commands running on the server itself.
A gadget chain to state change
Feed the server a serialized object it will trust and rebuild.
Argument injection into a called binary
Turn a foothold into commands running on the server itself.
From deserialization gadget to shell
Turn a foothold into commands running on the server itself.
From deserialization to file write
Feed the server a serialized object it will trust and rebuild.
Gopher-smuggling a request to an internal service
Make the server fetch a URL of your choosing, from inside its network.
Redirect-hopping into a private range
Make the server fetch a URL of your choosing, from inside its network.
Template injection to command execution
Turn a foothold into commands running on the server itself.
XXE escalated to a file read and beyond
Turn a foothold into commands running on the server itself.