01
2 labs
Open Redirect
Spot redirect parameters, read status codes, bypass filters. Lesson rule: follow the parameter, then attack the filter — never the payload list.
Open menu →
02
16 labs
Cross-Site Scripting
Follow your input from reflection to execution. Context decides the payload — marker first, read the HTML, then adapt.
Open menu →
03
3 labs
Content Security Policy
Read the policy before fighting it. Every tag answers to its own directive; allowances added for features are the holes.
Open menu →
04
4 labs
Cross-Site Request Forgery
Any state-changing action can carry CSRF; only the crucial ones are worth reporting. Find the action, read its request, host the POC, validate cross-account.
Open menu →
05
2 labs
Cross-Origin Resource Sharing
Two response headers decide the blast radius: Allow-Origin says who may read the reply, Allow-Credentials says whether cookies ride along. Reflection turns both into a leak.
Open menu →
06
4 labs
postMessage
Windows, tabs and frames talk across origins through postMessage — and both mouths of the bridge matter: the receiver validates event.origin, the sender pins targetOrigin to the expected parent. A missing check on either side turns messages into payloads.
Open menu →