Web Application Security
Test and harden web apps against injection, broken access control and more.
11 labs
Beginner
Web App Authentication: Find, Confirm & Fix (Basic)
Hands-on with Authentication Weakness (brute force) (CWE-307) in Acme Accounts's login feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App Broken Access Control: Find, Confirm & Fix (Basic)
Hands-on with Broken Access Control (IDOR) (CWE-639) in Acme Billing's invoice viewer (/invoice?id=). Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App Command Injection: Find, Confirm & Fix (Basic)
Hands-on with Command Injection (CWE-78) in Acme Ops Console's host-diagnostics (ping) feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App CSRF: Find, Confirm & Fix (Basic)
Hands-on with Cross-Site Request Forgery (CSRF) (CWE-352) in Acme Bank's change-password / money-transfer actions. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App File Inclusion: Find, Confirm & Fix (Basic)
Hands-on with File Inclusion (LFI/RFI) (CWE-98) in Acme CMS's page renderer (?page=). Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App File Upload: Find, Confirm & Fix (Basic)
Hands-on with Unrestricted File Upload (CWE-434) in Acme Portal's avatar/document upload feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App SQL Injection: Find, Confirm & Fix (Basic)
Hands-on with SQL Injection (CWE-89) in Acme Store's login / product-search feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App SSRF: Find, Confirm & Fix (Basic)
Hands-on with Server-Side Request Forgery (CWE-918) in a web app's URL-fetch feature. Safely reproduce it with an inert training tool (reach an internal service and the cloud metadata endpoint), classify it as SSRF, score it with CVSS, then fix it with a host allowlist that blocks link-local/metadata and disables redirects, and verify.
Beginner
Web App SSTI: Find, Confirm & Fix (Basic)
Hands-on with Server-Side Template Injection (SSTI) (CWE-1336) in Acme Mailer's greeting/personalization feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App XSS: Find, Confirm & Fix (Basic)
Hands-on with Cross-Site Scripting (XSS) (CWE-79) in Acme Community's comment feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App XXE: Find, Confirm & Fix (Basic)
Hands-on with XML External Entity (XXE) (CWE-611) in Acme Invoicing's XML import feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.