Stored XSS Leads to Session Hijacking | DillyDent
Lab Link DillyDent Overview DillyDent was a WebVerse Pro daily challenge based on a small dental clinic website with a live reception chat feature. The application allowed visitors to send me...
Kelvin Security Labs
Command Injection through EXIF Metadata Processing | PhotoStore
Lab Link PhotoStore Overview The Smile lab exposed an image-processing feature that extracted and processed EXIF metadata from uploaded JPEG files. During testing, the ImageDescription EXIF fiel...
Path Traversal Leads to Access Control Bypass | Gassed Up
Lab Link Gassed Up Overview Gassed Up was a WebVerse Pro challenge based on a public-facing fuel company website. The application exposed normal marketing pages through a custom page router: /r...
SVG XXE Leads to Local File Disclosure | Educated
Lab Link Educated Overview The Educated challenge presented a retro school message-board application with a newly added profile-picture feature. The profile page allowed users to upload avatar i...
Insecure Deserialization Leads to Dealer Portal Access | Scooot
Lab Link Scooot Overview Scooot is a WebVerse Pro mystery challenge built around an electric scooter storefront. The public application exposes a normal retail experience, while the trade portal...
Server-Side Template Injection via Vault Secret Rendering | SwitchBack
Lab Link Lab: SwitchBack Overview SwitchBack is a multi-service web challenge built around trust-boundary mistakes between public partner tooling, an internal mail system, and a Vault applicat...
Information Disclosure via Exposed Git Repository | GamedYourself
Lab Link WebVerse Pro - GamedYourself Overview GamedYourself was a WebVerse Pro challenge themed around a retro arcade/pinball site. The application itself looked like a normal public-facing w...
Password Reset Poisoning to Twig SSTI RCE | Inked
Lab Link Inked Overview Inked was an end-to-end web exploitation lab built around Jill’s Tatt Shop. The application had a public booking site, a separate staff dashboard, and a CRM API used by...
JWT Algorithm Confusion Leads to Privilege Escalation | Bomb Threat
Lab Link WebVerse Pro - Bomb Threat Overview Bomb Threat was a WebVerse Pro medium-difficulty lab centered around a critical NEXUS Control portal. The application exposed a login flow, email-b...
SSRF via PDF Renderer Leads to Internal Service Disclosure | ReportVerse
Lab Link ReportVerse Overview ReportVerse is a PDF report generator that accepts a user-supplied data source URL and renders the response into a downloadable PDF report. During testing, the a...