3 labs
Broken Access Control / IDOR
An object reference, such as an id, a filename or a token, that the server trusts without checking who actually owns it.
Learn & break it
Learn
Academy
One vulnerability class at a time: read what it is and how it works, then break it yourself in a hands-on lab.
3 labs
SQL Injection
Untrusted input concatenated straight into a query, letting an attacker change what the query does.
Learn & break it
3 labs
Cross-Site Scripting
Attacker-controlled content that ends up running as JavaScript in someone else's browser.
Learn & break it
2 labs
Server-Side Request Forgery
The server fetches a URL on your behalf, and nothing stops that URL from pointing somewhere it shouldn't.
Learn & break it
2 labs
Authentication & Session Flaws
Small mistakes in login, reset and session handling that individually look harmless and add up to account takeover.
Learn & break it
2 labs
File Upload
An upload handler that checks the wrong thing, or checks the right thing and stops there.
Learn & break it
2 labs
XXE
An XML parser that resolves external entities lets a document read files or reach internal services on the server's behalf.
Learn & break it
2 labs
SSTI
User input compiled and executed as a template, not merely inserted into one.
Learn & break it
2 labs
Insecure Deserialization
Attacker-controlled serialized data reconstructed into objects, triggering a magic method with attacker-chosen inputs.
Learn & break it
2 labs
JWT Attacks
A verifier that trusts the algorithm a token claims for itself, rather than enforcing one server-side.
Learn & break it
2 labs
OS Command Injection
User input reaching a shell command unescaped, letting an attacker append a second command of their own.
Learn & break it
3 labs
Business Logic Flaws
A step in the application's own workflow that can be skipped, repeated, or reordered in a way the design never accounted for.
Learn & break it