Lab Link Lab: snooker Overview The Snooker challenge demonstrates a business logic vulnerability where security-sensitive pricing information was trusted from client-controlled data. The applic...
Lab Link Lab: Heartwood Outfitters Overview Password reset functionality is commonly implemented to improve usability, but weak reset mechanisms frequently become direct paths to account comprom...
Lab Link Lab: Header Hunt Overview Applications often expose more information than intended through HTTP response headers. During development, engineers may add custom headers for troubleshootin...
Lab Link Lab: Lazy Human Resources Overview The Lazy Human Resources challenge demonstrates a classic workflow authorization flaw where the application relies on client-side restrictions rather ...
Lab Link Lab: Crate & Sleeve Overview The Crate & Sleeve challenge appears to demonstrate a Stored Cross-Site Scripting (Stored XSS) vulnerability within community comment functionality....
Lab Link Lab: Halftrack Model Railroad Club Overview The Halftrack Model Railroad Club challenge demonstrates an authentication weakness caused by predictable usernames, weak passwords, and miss...
Lab Link Lab: Gatekeeper Overview The Gatekeeper challenge demonstrates a classic SQL Injection authentication bypass vulnerability. The application contained an employee login portal intended ...
Lab Link Lab: Crosswind Overview The Crosswind challenge demonstrates an Unrestricted File Upload vulnerability leading to Remote Code Execution (RCE). The application allowed users to upload p...
Overview The Caretaker lab simulates a public-facing archive system for Beaumont Psychiatric Hospital. The application exposes diary entries through a searchable interface that appears to be safel...
Overview JoyStick is a real-time order tracking platform built around live WebSocket updates. The application pushes order state changes instantly without requiring page refresh, which is its core...