Use labs as the execution layer of your learning plan, then capture the technique in practice and notes.
Real vulnerable web apps. Attack with your browser or Burp Suite.
You need to sign in to start a lab. Progress and XP are saved to your account.
Exploit a vulnerable login form with classic SQL injection. Extract the admin's secret from the database.
The search page reflects the ?q= parameter directly into the HTML response without sanitization.
Inject a persistent script into a comment board. An admin bot reads comments every 30 seconds — steal its cookie.
The account update form has no CSRF token. Craft a forged request that the admin bot executes.
The order API returns any order by ID without checking ownership. Find the admin's private order.
A file download endpoint constructs paths from user input. Escape the web root and read sensitive files.
The password reset flow uses a predictable token. Intercept or brute-force it to take over the admin account.
The API uses JWT for auth but accepts the 'none' algorithm. Forge an admin token without knowing the secret.
A URL-fetching endpoint has no validation. Use it to reach an internal metadata service.
A coupon code can be applied multiple times by sending concurrent requests before the use_count increments.
Exploit unsafe SQL construction in a realistic financial portal to bypass authentication and gain administrator access. Then investigate the search functionality and use UNION-based SQL injection to extract backend database information.