Web Exploitation
10 missionsSQL Injection
The login form at /login does not sanitize user input. Bypass authentication using a classic SQLi payload.
#6IDOR
The profile page at /profile?id=102 returns your data, but it does not enforce authorization. Access an admin account.
#7Cookie Tampering
The role cookie is base64 encoded. Decode it, change your privileges, and resubmit.
#14Command Injection
A diagnostics page pings user-supplied IPs without validation. Inject a secondary command.
#15JWT None Algorithm
The admin endpoint trusts JWTs signed with the "none" algorithm. Forge a token.
#17XSS Stealer
A comment box is vulnerable to stored XSS. Exfiltrate an admin cookie.
#22XXE - XML External Entity
An API imports XML without disabling external entities. Read internal files through XML.
#23LFI - Local File Inclusion
A document viewer loads files based on a file parameter. Traverse directories to read system files.
#24NoSQL Injection
The NoSQL login query trusts JSON operators. Bypass authentication with a JSON payload.
#34Hidden Admin Profile
The user profile endpoint is vulnerable to IDOR. The admin profile is hidden at an unexpected ID.