These challenges put you in front of a deliberately vulnerable web
application. Read the page, poke at the inputs, and find the flag
the developers left exposed.
Read the scenario, solve the task, then submit the flag you
found. Hints are there if you need them — every correct
answer ends with an explanation.
Your Progress
0/ 4
0 pts
WEB-01Easy50 ptsUnsolved
Hidden in Plain Sight
The login page for a small company portal looks ordinary. A
developer left a note to themselves somewhere the browser does
not display, and it contains the flag.
Lab
A simulated staff portal. Inspect it the way an attacker
would.
A simulated staff portal with a secret left in the page
source. Open it and inspect the way an attacker would.
Nothing here needs an exploit. View the page source, then
check the files a site exposes by habit —
robots.txt and old backups.
What this challenge taught you
Anything sent to the browser is readable by the user,
including HTML comments, JavaScript, and files left in the web
root. Secrets belong on the server, never in client-side code.
WEB-02Easy75 ptsUnsolved
Guest Access
You log in with a guest account and reach a limited dashboard.
The application decides what you may see from a value it stores
in your browser.
Lab
A simulated guest dashboard that trusts a value stored in your
browser.
A simulated dashboard that decides what you may see from a
value kept in your browser.
Open your browser’s storage inspector and look at the
cookies for the site. One of them describes who the
application thinks you are.
What this challenge taught you
Authorization decided from client-side values is no
authorization at all, because the client controls them. Roles
and permissions have to be checked on the server against the
session.
WEB-03Medium100 ptsUnsolved
The Quotation Mark
The staff login form builds its database query by pasting your
username straight into a string. Get in without knowing a
password.
Lab
A simulated staff login whose query is built by pasting in
your input.
A simulated staff login whose query is built by pasting your
input straight in.
Think about what a single quote does to a query that was not
expecting one, and what happens when the condition after it is
always true.
What this challenge taught you
SQL injection happens when input becomes part of the query
rather than data within it. Parameterized queries, or prepared
statements, keep the two separate and shut the whole class of
attack down.
WEB-04Hard125 ptsUnsolved
Leaky Endpoint
The portal loads your profile from an API call that names your
account number. Another user’s record holds the flag.
Lab
A simulated profile page that loads records by account number.
A simulated profile page that loads records by account number.
Watch the network requests the page makes while it loads your
profile, then ask what stops you requesting a different
identifier.
What this challenge taught you
This is an insecure direct object reference: the server trusts
the identifier the client sends without checking that this
user may read that record. Every request needs an ownership
check, not just a valid session.
Flags are checked on the server: the page never holds the answers,
and your solves are saved to your account and counted on the
scoreboard.
Flags captured. Ready for the next track?
Keep going, or check how many flags you have captured so far.