Exploit intentionally vulnerable local applications, collect evidence, identify root causes, apply secure fixes, and retest the attack through guided missions.
For authorized local training only. All data and endpoints are fictional and simulated in your browser.
IDOR / BOLA on a fictional orders API
A fictional orders endpoint returns any record by ID with no ownership check. Discover the IDOR, prove it, and enforce ownership validation.
No rate limiting, no lockout, leaky errors
A fictional login accepts unlimited attempts and leaks whether the username or the password was wrong. Add rate limiting, lockout, generic errors, and logging.
Unrestricted object binding → privilege escalation
A fictional profile update binds every submitted field to the record. Add a protected "role" field to escalate to admin, then enforce a server-side allowlist.