Two marathon sessions. 60 labs. 20+ vulnerability categories. This is the complete reference.
JWT (5 labs, all P1)
JWT (5 labs, all P1)
Unverified signature, alg:none, weak signing key (hashcat brute force), JWK header injection (embed own RSA key), kid path traversal to /dev/null.
XSS (16 labs)
16 context-specific payloads: attribute injection, JS protocol href, string break, template literal, HTML entity onclick, backslash escape, script close, AngularJS, SVG animatetransform, canonical accesskey, DOM select close, reflected DOM eval, stored DOM replace bypass, body onresize, custom tag, XSS-to-CSRF chain.
CSRF (6 labs)
No defenses, token absent, method override POST-to-GET, SameSite Lax via _method, SameSite Strict via redirect gadget, token not tied to session.
Everything Else
SSRF (3), SQLi (5), NoSQL (3), XXE (2), SSTI (1), File Upload (2), Access Control (5), Deserialization (1), CORS (2), WebSocket XSS (1), Web Cache Deception (2), GraphQL (1), Logic Flaws (3), Info Disclosure (4), Authentication (3), LLM Attacks (3).
No comments yet