I don't appreciate it ky.

Each challenge simulates a real vulnerability in a way that feels like a real app. You’ll see the feature, understand the code, spot the flaw, exploit it (safely), then flip to Secure Mode and see the fix.

Progress: 0 / 10 complete
Recruiter Mode Reset Progress
Recruiter Mode hides the exploit editor and focuses on explanation + fixes.
This project is intentionally vulnerable inside this sandbox. Do not copy insecure patterns into production.

All Challenges

Pick one. Each page is section-based, interactive, and visually distinct.

Beginner Insecure Direct Object Reference (IDOR)

👤 Broken Access Control

Access another user's private account data.

Try: Modify the user identifier in the request.

Explore →
Beginner Header Spoofing

🛂 Trusting Client Headers

Gain access to admin-only features.

Try: Add or modify a privileged request header.

Explore →
Beginner Client ≠ Server

🔒 Client-Side Authorization

Unlock premium features without proper authorization.

Try: Toggle a client-controlled flag.

Explore →
Beginner Base64 Misuse

🧩 Encoding Is Not Encryption

Recover a sensitive value hidden with encoding.

Try: Decode the exposed value.

Explore →
Intermediate Brute Force Attacks

⏱️ Missing Rate Limiting

Attempt repeated logins without restriction.

Try: Increase the number of attempts.

Explore →
Beginner Weak Defaults

🤖 Default Credentials

Log in using commonly known credentials.

Try: Try typical default values.

Explore →
Intermediate Unvalidated Redirect Targets

➡️ Open Redirect

Redirect users to an external destination.

Try: Change the redirect target parameter.

Explore →
Intermediate Unsafe Output Handling

🧨 Reflected XSS (Simulated)

Inject markup into a server response.

Try: Supply HTML-like input.

Explore →
Intermediate Improper File Access

📁 Path Traversal

Access files outside the intended directory.

Try: Manipulate the file path.

Explore →
Advanced Cross-Origin Data Exposure

🌐 CORS Misconfiguration

Read sensitive API data from another origin.

Try: Send a request from an untrusted origin.

Explore →