Web Security Training Platform
Master cybersecurity vulnerabilities through hands-on labs designed to challenge and enhance your penetration testing skills.
Vulnerability Categories
Cross-Site Scripting
LAB
Easy
Training
Reflected XSS - PubMed: National Library of Medicine Search Builder
LAB
Hard
Training
IMDb: Ratings, Reviews, and Where to Watch the Best Movies & TV Shows
LAB
Hard
Training
MilesWeb: Fast, Secure & Reliable Web Hosting Built for Indian Websites
HTML Injection
Open Redirect
Authentication Bypass
No Rate Limiting
LAB
Yelp for Business - Missing Rate Limiting on Subscription Form
LAB
On Running - Missing Rate Limiting on Partner Authentication Endpoint
LAB
Courier - Missing Rate Limiting on User Registration & Email Enumeration
LAB
WakaTime - Rate Limit Too Lenient on Password Reset Endpoint
LAB
Redditgifts - Missing Rate Limiting on Adding Comments
LAB
Nextcloud - Missing Rate Limiting on Newsletter Subscription Endpoint
LAB
UPchieve - Missing Rate Limiting on Contact Us Endpoint
LAB
Algolia - Missing Rate Limiting on Two-Factor Authentication (2FA) Code Verification
LAB
UPchieve - Missing Rate Limiting on Password Reset Endpoint
LAB
Yelp for Business - Missing Rate Limiting on Resend Confirmation Email Endpoint
LAB
MTN Group - Missing Rate Limiting on 5-Digit OTP Verification Endpoint
Race Condition
LAB
Slack - Race Condition in Account Creation Survey (Unlimited Credits)
LAB
Omise - Race Condition in Team Member Invitations
LAB
HackerOne - Race Condition in Claiming Program Credentials
LAB
Hacker101 CTF - Race Condition in Flag Submission
LAB
Urban Dictionary - Race Condition in Definition Votes
LAB
Dust - Race Condition in Folder Creation (Folder Limit Bypass)
Username/Email Enumeration
Parameter Tampering
SQL Injection
LAB
Time-Based Blind SQLi - U.S. Dept Of Defense
Cross-Site Request Forgery
Server-Side Template Injection
LAB
Hard
Training
CloudGuard - Enterprise Compliance & Security Report Engine Code Execution
LAB
Hard
Training
TornadoAlert - Python SRE Incident & Webhook Notification Code Execution
Server-Side Request Forgery
Local File Inclusion
Remote Code Execution
Insecure Direct Object Reference
LAB
Uber Driver Portal - Trip & Earnings Disclosure
Remote File Inclusion
LAB
RFI + XSS + SSRF via Unvalidated URL Proxy in GIS Portal (U.S. DoD)
LAB
Medium
Training
ShopStream - E-Commerce Bulk Product Import Remote & Local File Inclusion
LAB
Medium
Training
StreamFlux - Video Analytics CDN Origin Asset Proxy Remote & Local File Inclusion
XML External Entity
LAB
XXE on Twitter SMS SXMP API (File Read via operatorId Error Reflection)
LAB
LFI + SSRF via XXE in SVG Emblem Editor (Rockstar Games ImageMagick)
LAB
Blind XXE via JPEG XMP Metadata Injection (Informatica OOB Exfiltration)
LAB
XXE via XML Resume Upload Starbucks China Career Portal (IIS + ASP.NET)