Spawn Virtual Machines to Practice and Test Your Skills.
Boot disposable, network-isolated lab machines in seconds. Free ranges sit next to premium ones — launch, break things, reset, repeat.
Available Labs
Free labs are open to everyone. Premium labs unlock the connection pack and target once you get access.
SQL injection: UNION-based data extraction
A product category filter builds its SQL by string concatenation. Use a UNION SELECT to read the application's user credentials.
SQL injection: blind extraction with time delays
The app runs a query on the `TrackingId` cookie but never shows the result or an error. Use conditional `SLEEP()` to read the admin password one character at a time.
Reflected XSS in a search field
The search term is reflected into the HTML response with no encoding. Craft a URL that pops an alert in the victim's browser.
CSRF with no defences: forced email change
The change-email endpoint has no CSRF token and relies only on the session cookie. Build an auto-submitting form that changes a victim's email.
XXE for local file disclosure
A stock-check feature parses an XML body with external entities enabled and reflects a value into the response. Read `/etc/passwd`.
API recon: finding hidden parameters
An undocumented REST API backs the site. Discover the endpoints and a hidden parameter that unlocks a price override.
Web cache deception: exploiting path delimiters to cache a profile page
The cache stores responses by file extension; the origin ignores a path suffix after a delimiter. Combine them to trap a victim's account page in the shared cache.
Blind XXE via a malicious external DTD
Same stock-check parser, but nothing is reflected. Host an external DTD that exfiltrates a file over HTTP to your server.
Indirect prompt injection via product reviews
The shop's LLM assistant reads product reviews into its context and can call tools. Plant a review that makes it act against the next user who asks about that product.
Stored XSS to session theft in blog comments
Comments are stored and re-rendered as raw HTML. Plant a payload that exfiltrates the session cookie of everyone who views the post.
API mass-assignment privilege escalation
The profile-update endpoint binds the whole JSON body to the user model. Set a field the UI hides and become an administrator.
CSRF with broken token validation
The endpoint has a CSRF token, but it is only validated when the parameter is present. Drop it and the check is skipped.