Overview This lab demonstrates a UNION-based SQL Injection vulnerability in a search feature. The application directly embeds user input into SQL queries and reflects the results in the response. ...

Overview This lab demonstrates a Path Traversal vulnerability in the image-fetching functionality of the Ottergram application. By manipulating a file parameter, it was possible to access arbitrar...

Overview This lab demonstrates an Insecure Direct Object Reference (IDOR) vulnerability in a public library web application called Overdue. The issue allows an attacker to access other users’ che...

Overview The Corridor challenge from Webverse simulates a literary magazine website called Ridgeline Press. At first glance, the application appears to serve static story content. However, deeper ...

Overview Sokudo is a typing speed tracking web application. During testing, a critical flaw was identified in its authentication mechanism, where authorization tokens were generated using predicta...

Overview This lab involves a vulnerable e-commerce application named Flower, where a SQL Injection flaw exists in the product search functionality. The vulnerability allows an attacker to manipula...

Overview This lab focuses on a notes web application where restricted admin access was protected using an adminAccessToken. While normal authentication was handled via JWT, the admin panel relied ...

Overview Tanuki is a web application that includes a user registration system with role-based access control. During testing, a critical authorization flaw was discovered where the client was able ...

Overview Diceforge is a web-based dice simulation application where users can select different dice types (e.g., d6, d8) and roll them to generate results. The backend processes user input and retu...

Overview Ottergram is a prototype social media web application similar to Instagram, featuring account registration, post creation, and image uploads. While exploring the application’s functionalit...