THE BEGINNER PATH
Your curiosity. Put to work.
One fake shop. Four ways to see what a website should protect.
YOUR PROGRESS
Start your first lab ↗0 / 4 labs complete
Saved in this browser · 0 XP of 600 XP
All four labs complete. Nicely investigated.
You’ve learned to check who owns data and keep user input separate from SQL. Revisit any lab to practice.
01 / ACCESS & OWNERSHIP
Broken access control
Sometimes a website checks that you are logged in, but forgets to check which data you are allowed to see.
02 / INPUT & DATABASES
SQL injection
Some websites mix user input directly into database commands. This can make the database do things it should not do.
Your pace. Your progress. Hints never cost XP.
Desktop or laptop recommended. Some challenges use browser Developer Tools.
THE FIRST 100
Leave your mark on the lab.
Complete both tracks. Claim a numbered founding badge. Bring the next hacker along.