Every lab in the Academy catalogue, one vulnerability class each.
A staff portal keeps your role in an unsigned cookie you can rewrite.
6 solves
A parking-permit portal addresses permits by a random token, but a directory API leaks everyone's token.
18 solves · favorite 1
A coworking day-pass booking site. The price is a hidden form field the server trusts as submitted.
8 solves
A network uptime checker. The host field is concatenated straight into a shell ping command.
5 solves
An internal help-desk system. The token verifier accepts whatever algorithm the token's header claims, including none.
7 solves
A photo-album app. A shared-preferences cookie is restored with a bare unserialize() call.
0 solves
A sticky-note app. A custom greeting is compiled directly as an unsandboxed Twig template.
3 solves
A freelance invoicing tool. Uploaded invoice XML is parsed with external entity loading left on.
1 solve
A client-proofing photo gallery. The extension blacklist misses .phtml.
1 solve
A padel and tennis court booking site. The reset code is derived from the send time, with no rate limit.
3 solves
A document-notarization service. The completion webhook URL is fetched server-side with no restriction.
1 solve
A hiking-trail conditions report. The location query is echoed back unescaped.
14 solves