Labs
Each lab provisions a fresh, isolated environment just for you. No shared targets, no interference.
8 labs found
SQL Injection Fundamentals
Learn how SQL injection works by exploiting a vulnerable login form. Extract the admin password using UNION-based injection techniques.
Stored Cross-Site Scripting
Inject persistent JavaScript into a comment section and steal the admin's session cookie. Master the most common XSS variant.
Server-Side Request Forgery
Exploit an SSRF vulnerability in an image proxy to access internal services. Pivot from the web server to the metadata endpoint.
OS Command Injection
Break out of a ping utility input to execute arbitrary shell commands. Escalate from command execution to a reverse shell.
JWT Token Manipulation
Forge and manipulate JSON Web Tokens to escalate privileges. Exploit algorithm confusion and weak signing keys.
Insecure Deserialization
Craft malicious serialized objects to achieve remote code execution through an unsafe deserialization endpoint.
XML External Entity Injection
Exploit XXE vulnerabilities in an XML parser to read local files, perform SSRF, and trigger denial-of-service conditions.
NoSQL Injection
Bypass authentication and extract data from a MongoDB backend using NoSQL injection operators in JSON payloads.