Web Security Training Platform
Master cybersecurity vulnerabilities through hands-on labs designed to challenge and enhance your penetration testing skills.
Vulnerability Categories
Content Discovery
Hidden Parameter Fuzzing
Cross-Site Scripting
LAB
Easy
Training
Reflected XSS - PubMed: National Library of Medicine Search Builder
LAB
Hard
Training
DOM XSS - IMDb: Ratings, Reviews, and Where to Watch the Best Movies & TV Shows
LAB
Hard
Training
DOM XSS - MilesWeb: Fast, Secure & Reliable Web Hosting Built for Indian Websites
HTML Injection
Open Redirect
LAB
Open Redirect Vulnerability in OAuth Flow Leading to Potential Phishing Attack
LAB
Open Redirect via "next" parameter in third-party authentication
LAB
Reflected XSS via Unvalidated / Open Redirect in Uber
Authentication Bypass
LAB
Admin Authentication Bypass Lead to Admin Account Takeover
LAB
Email Verification code bypass in account registration process
LAB
Authentication Bypass Leads To Complete Account TakeveOver
LAB
Authentication Bypass with usage of PreSignedURL
LAB
Authentication bypass leads to Information Disclosure
No Rate Limiting
LAB
Yelp for Business - Missing Rate Limiting on Subscription Form
LAB
On Running - Missing Rate Limiting on Partner Authentication Endpoint
LAB
Courier - Missing Rate Limiting on User Registration & Email Enumeration
LAB
WakaTime - Rate Limit Too Lenient on Password Reset Endpoint
LAB
Redditgifts - Missing Rate Limiting on Adding Comments
LAB
Nextcloud - Missing Rate Limiting on Newsletter Subscription Endpoint
LAB
UPchieve - Missing Rate Limiting on Contact Us Endpoint
LAB
Algolia - Missing Rate Limiting on Two-Factor Authentication (2FA) Code Verification
LAB
UPchieve - Missing Rate Limiting on Password Reset Endpoint
LAB
Yelp for Business - Missing Rate Limiting on Resend Confirmation Email Endpoint
LAB
MTN Group - Missing Rate Limiting on 5-Digit OTP Verification Endpoint
Race Condition
LAB
Slack - Race Condition in Account Creation Survey (Unlimited Credits)
LAB
Omise - Race Condition in Team Member Invitations
LAB
HackerOne - Race Condition in Claiming Program Credentials
LAB
Hacker101 CTF - Race Condition in Flag Submission
LAB
Urban Dictionary - Race Condition in Definition Votes
LAB
Dust - Race Condition in Folder Creation (Folder Limit Bypass)
OAuth Misconfiguration
Information Disclosure
LAB
Information disclosure of another company bug on video
LAB
Partial disclosure of report activity through new "Export as .zip" feature
LAB
Possible PII Disclosure via Advanced Vetting Process
LAB
Sensitive information disclosure to shared access user via streamlabs platform api
Username/Email Enumeration
LAB
Discoverability by phone number/email restriction bypass
Using Default Credentials
LAB
Default Credentials on Kinetic Core System Console
LAB
Default Admin Username and Password on MTN Group
LAB
Staging Rabbitmq instance is exposed to the internet with default credentials
LAB
Access nagios dashboard using default credentials in U.S. General Services Administration
LAB
Default Admin Username and Password on U.S. Dept Of Defense
SQL Injection
LAB
Time-Based Blind SQLi - U.S. Dept Of Defense
Cross-Site Request Forgery
LAB
CSRF on /api/graphql allows executing mutations through GET requests
LAB
Reflected XSS by exploiting CSRF vulnerability on Starbucks
Insecure Direct Object Reference
LAB
Uber Driver Portal - Trip & Earnings Disclosure
LAB
Allows Viewing Private Report Details via /bugs.json Endpoint
LAB
Account Deletion via Session Misbinding - Attacker Can Delete Victim Account
LAB
IDOR when editing email leads to Account Takeover on Atavist
LAB
IDOR to view order information of users and personal information
LAB
IDOR in "external status check" API leaks data about any status check on the instance
LAB
[IDOR] Improper Access Control on Embedded Submission Form
LAB
IDOR in API applications (able to see any API token, leads to account takeover)
LAB
IDOR on GraphQL queries BillingDocumentDownload and BillDetails
LAB
IDOR allows an attacker to delete anyone's featured photo
LAB
IDOR Leads To Account Takeover Without User Interaction
LAB
IDOR leads to view other user Biographical details (Possible PII LEAK)
LAB
IDOR on Acronis API lead to steal private business user information
Privilege Escalation
Local File Inclusion
Remote Code Execution
LAB
Unrestricted File Upload - PHP Profile Picture Leads to Remote Code Execution
Server-Side Template Injection
LAB
Medium
Training
DevSpace - Developer Profile Personalization & Custom Bio SSTI (Jinja2)
LAB
Medium
Training
DevWiki - DevOps Team Knowledge Base & Markdown Macro SSTI (Tornado)
LAB
Medium
Training
PageCraft - Modular CMS Landing Page & Hero Studio SSTI (Ruby ERB)
LAB
Medium
Training
PulseFeedback - Customer Onboarding & Survey Receipt SSTI (FreeMarker)
LAB
Server Side Template Injection on Name parameter during Sign Up process
LAB
Uber may RCE by Flask Jinja2 Template Injection
LAB
Urgent: Server side template injection via Smarty template allows for RCE
Server-Side Request Forgery
LAB
Server-Side Request Forgery using Javascript allows to exfill data from Google Metadata
LAB
blind Server-Side Request Forgery (SSRF) allows scanning internal ports
LAB
Bypass of the SSRF protection in Event Subscriptions parameter
LAB
SSRF in webhooks leads to AWS private keys disclosure
LAB
Server Side Request Forgery (SSRF) in webhook functionality
XML External Entity
LAB
XXE on Twitter SMS SXMP API (File Read via operatorId Error Reflection)
LAB
LFI + SSRF via XXE in SVG Emblem Editor (Rockstar Games ImageMagick)
LAB
Blind XXE via JPEG XMP Metadata Injection (Informatica OOB Exfiltration)
LAB
XXE via XML Resume Upload Starbucks China Career Portal (IIS + ASP.NET)
HTTP Request Smuggling
Cache Poisoning
Business Logic Errors
LAB
Easy
Training
Client-Side Price Manipulation Allows Purchasing Any Product for $1
LAB
Easy
Training
Product Price Parameter Tampering Allows Purchasing Items Below Listed Price
LAB
Easy
Training
Coupon Code Reuse Logic Flaw Allows Applying the Same Discount Multiple Times
LAB
Easy
Training
Negative Transfer Amount Abuse Allows Stealing Funds from Other Wallets
LAB
Easy
Training
Missing Idempotency on Claim Submission Allows Duplicate Expense Payouts
LAB
Medium
Training
Return Cancellation Does Not Reverse Wallet Refund Allowing Double Payout
LAB
Hard
Training
Race Condition Bypass Allows Purchasing Flash Sale Items Beyond the Per-Customer Limit
LAB
Business Logic Bypass Allows Setting “Read Access" Role Without Pro Plan Subscription
LAB
OLO Total price manipulation using negative quantities
LAB
An attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business loss
LAB
Bypassing the block of Security Domain Restriction and normally invite blocked domains with special characters “İ"
LAB
2FA disabled External user can participate in 2FA enabled program's report
Improper Access Control
LAB
Easy
Training
Improper Access Control Allows Unauthorized Profile Picture Takeover
LAB
Easy
Training
Improper Access Control Allows Unauthorized Access to Other Patients' Lab Reports via Unvalidated Report ID
LAB
Easy
Training
Missing Function-Level Access Control Allows Regular Employees to Export Confidential Payroll Data
LAB
Easy
Training
Improper Access Control Allows Cancelling Other Users' Event Tickets via Unvalidated Ticket ID
LAB
Easy
Training
Improper Access Control Allows Reading Private Message Threads via Unvalidated Thread ID in URL
LAB
Medium
Training
Mass Assignment Vulnerability Allows Self-Granting Admin Privileges via Unvalidated POST Fields
File Upload Vulnerabilities
Subdomain Takeovers
Remote File Inclusion
LAB
Medium
Training
ShopStream - E-Commerce Bulk Product Import Remote & Local File Inclusion
LAB
Medium
Training
StreamFlux - Video Analytics CDN Origin Asset Proxy Remote & Local File Inclusion
LAB
RFI + XSS + SSRF via Unvalidated URL Proxy in GIS Portal (U.S. DoD)