Welcome back
Cross-Site Scripting
Learn reflected XSS across HTML, attribute, and script contexts — then bypass a weak filter.
Open Redirect
Abuse redirect parameters to send victims to attacker-controlled sites.
SQL Injection
Dump secrets with error-based UNION injection, then extract data blindly.
Local File Inclusion
Traverse out of the images directory and read sensitive files.
Insecure Direct Object Reference
Enumerate account IDs and steal another user's details.
Cross-Site Request Forgery
Forge state-changing requests. Some actions lack tokens; one is protected.
File Upload
Bypass weak upload validators. Files stay inert — prove the bypass.
XML External Entity
Exploit XXE to read files. Entities resolve against a simulated filesystem only.
Server-Side Request Forgery
Make the server request internal resources. All fetches are simulated.
Remote Code Execution
Command injection and LFI-to-RCE. Commands run in a simulated shell only.
Broken Access Control
A mini course platform with hidden APIs, privilege escalation, IDOR, and a payment bypass.
Stored & Blind XSS
Plant persistent XSS and hit a simulated admin bot.
JWT Attacks
Forge admin access with alg:none or a weak HMAC secret.
Server-Side Template Injection
Jinja evaluates your input. Math first, then go deeper.
CORS Credential Theft
Reflected ACAO + credentials = steal the API response.
Auth Abuse
Host-header reset poisoning and a 2FA skip endpoint.
GraphQL IDOR
Enumerate GraphQL user objects and steal admin's secret.
Business Logic Bugs
Tamper price, reuse coupons, break quantities.
Race Condition
Double-redeem a gift card with parallel requests.
Second-Order SQLi
Store a payload in your bio, trigger it in admin search.
WAF Filter Gauntlet
Three escalating XSS filters. Bypass each stage.
Bug Chain: XSS → CSRF → ATO
One story. Three bugs. Take over the account email.
Boss: 0-Click ATO
Poison reset, predict token, own the account.
Weekly Hard Challenge
Progressive multi-stage hard room. Clear all three.
How rooms work
Each room is a category with numbered tasks. Open the linked lab, exploit it, then submit the flag or answer on the room page. Progress is stored in localStorage on this browser only — no account required. Labs are sandboxed: no real host files, shells, or outbound network.