17 guided labs against a realistic, deliberately vulnerable web app — from SQL injection to full remote code execution. Each with a Burp walkthrough, an attack script, and a one-line fix.
Start hacking → Explore the labsEvery attack has a script, a Burp walkthrough, and a one-line fix you can flip on and re-run.
Log in as admin without knowing the password by breaking out of the SQL query.
Skip the one-time-code step entirely by sending an empty OTP field.
Automate guessing the 4-digit code until the right one is found.
Recover a weak password from a small wordlist with no lockout in place.
Flood a slow endpoint on a single-worker server until it stalls for everyone.
Read a secret one-time-code straight out of a JSON API response.
Beat a 'max 3 attempts' limiter by firing many requests at once (TOCTOU).
Read other users' data through forced browsing and an IDOR in the account API.
Crack a weak Flask signing key and forge an admin session cookie.
Run your own JavaScript in the page via reflected and stored XSS.
Escalate a template bug from '7*7=49' to full remote code execution.
Chain an OS command onto a 'ping' feature to run arbitrary shell commands.
Climb out of an allowed folder with '../' to read the server's own source and /etc/passwd.
Run your own JavaScript purely client-side — the server never even sees the payload.
Upload a malicious file with no validation, then browse to it to run code on the server.
Go from an ordinary logged-in user to admin by editing a client-trusted cookie.
Steal a victim admin's real session cookie with stored XSS, then replay it to take over their account.