🧪 Labs

Make the database answer a question the application never meant to ask.

When user input becomes part of a server template, the template engine runs it.

A permissive XML parser can be told to fetch files and URLs for you.

A feature that shells out to a system command, with your input in the command line.

Turning attacker-controlled bytes back into live objects can run attacker code.

Script you save in the app runs in every visitor's browser.

The app checks the number on the door, not whether the door is yours.

An API hands you any record by id — without checking it's yours. IDOR for APIs.

A privileged action that only the UI hides — call it directly and it runs.

Make the server fetch a URL of your choosing — including ones you can't reach.

When a token's signature isn't verified properly, you can rewrite who you are.

The login dance has several moving parts — and skipping a check in any of them breaks it.

A file path built from your input can be walked out of its intended folder.

An upload that trusts the filename or the content type can become code on the server.

Write attacker text into a log the server will later include, and a file read becomes code execution.

A single flexible endpoint that often tells you more than it should.

Fire the same action many times at once and slip through the gap before the check catches up.

Send fields the form never showed you, and the server saves them anyway.

Poison the base object every other object inherits from, and change behaviour everywhere.

Trick the cache into storing the wrong thing — then serve it to everyone.

Make a logged-in victim's browser send a state-changing request they never intended.

An app that tells you whether a decryption 'looked right' leaks the plaintext, one byte at a time.

A secret that's short, guessable, or generated predictably isn't a secret.

A signature check that's lenient in the wrong place lets forged data through.

Hashes used the wrong way — for integrity, for passwords, for tokens — break in predictable ways.