Every lab in the Academy catalogue, one vulnerability class each.
A coworking day-pass booking site. The price is a hidden form field the server trusts as submitted.
2 solves
A network uptime checker. The host field is concatenated straight into a shell ping command.
2 solves
An internal help-desk system. The token verifier accepts whatever algorithm the token's header claims, including none.
1 solve
A photo-album app. A shared-preferences cookie is restored with a bare unserialize() call.
0 solves
A sticky-note app. A custom greeting is compiled directly as an unsandboxed Twig template.
0 solves
A freelance invoicing tool. Uploaded invoice XML is parsed with external entity loading left on.
0 solves
A client-proofing photo gallery. The extension blacklist misses .phtml.
0 solves
A padel and tennis court booking site. The reset code is derived from the send time, with no rate limit.
0 solves
A document-notarization service. The completion webhook URL is fetched server-side with no restriction.
0 solves
A hiking-trail conditions report. The location query is echoed back unescaped.
5 solves
A pet-adoption directory. The breed filter concatenates straight into the query.
1 solve
A peer-to-peer car rental app. Find a way to read another user's booking.
3 solves