Labs

Reflect a payload in a search box and execute script.

Persist a payload in a blog comment that runs for every viewer.

Exploit client-side sinks that write untrusted data into the DOM.

Bypass authentication with a classic tautology.

Use UNION SELECT to pull data from another table.

Change a victim’s email with a forged request.

Poison the reset link host so tokens go to you.

Read /etc/passwd via ../ sequences.

Make the server request an internal admin page.

Change an ID parameter to view another account.

Steal data via a reflected Access-Control-Allow-Origin.

Crack a weak MD5 digest from a tiny wordlist.

Redeem a single-use coupon twice via parallel requests.

Name the classic desync when the edge trusts Content-Length.

Query another user’s email through GraphQL.

Forge a token when signature checks are skipped.

Reveal hidden catalog rows by breaking a product filter query.

Identify the database engine using Oracle-specific version queries.

Pull @@version-style output from a injectable search.

List schema metadata then dump a sensitive table.

Query all_tables / dual patterns to map the schema.

Probe how many columns the original SELECT returns.

Locate which UNION slot echoes text into the page.

Concatenate fields inside a single UNION column.

Infer data from different page content on true vs false.

Force DB errors only when a guess is correct.

Use verbose SQL errors to leak data in the response body.

Confirm injectability with intentional sleep/delay.

Binary-search secrets using delay-on-true predicates.

Trigger a DNS/HTTP callback from the database tier.

Exfiltrate a secret over DNS/HTTP from SQL.

Encode a payload so a WAF misses the SQL metacharacters.

Abuse location.search reflected into innerHTML.

Set an anchor href from query input without sanitizing.

Trigger a selector sink when the URL hash changes.

Break out of an attribute when angle brackets are encoded.

Poison a stored link when quotes are encoded poorly.

Escape a JavaScript string context with encoded brackets.

Break out of options rendered via document.write.

Evaluate an expression when braces are still live.

Combine server reflection with a client sink.

Store data that later hits a DOM sink for other users.

Find an allowed event/tag combo past a denylist.

Abuse custom elements still permitted by the filter.

Use SVG markup that the filter still allows.

Inject into a canonical <link> reflection.

Bypass incomplete escaping inside a JS string.

Chain encodings to break out of a quoted string.

Land a payload in an onclick handler despite encoding.

Break Unicode-escaped template literal boundaries.

Exfiltrate document.cookie to prove impact.

Overlay or hook a login form via injected script.

Read a CSRF token from the DOM and forge a request.

Escape a legacy Angular sandbox without string literals.

Combine Angular quirks with a strict CSP.

Find an execution path when on* handlers are stripped.

Craft a JS URL despite blocked characters.

Smuggle data out when scripts are blocked by CSP.

Find a policy gap that allows XSS under CSP.

Abuse a GET (or method override) path that skips the token.

Omit the token entirely and still change state.

Reuse another user’s valid token in your request.

Set a cookie the server trusts as the CSRF secret.

Forge both copies of a duplicated CSRF value.

Trigger a state change across sites despite Lax.

Bounce through an on-site redirect to attach cookies.

Use a related subdomain to deliver the CSRF.

Refresh a cookie in a context that later allows CSRF.

Drop the Referer header to bypass validation.

Craft a Referer that fools a substring check.

Frame a sensitive action under an opaque decoy UI.

Pre-fill framed inputs from query params.

Defeat a simple frame-busting script.

Combine framing with a DOM sink for script execution.

Guide the victim through several framed clicks.

Handle an origin-unsafe web message that writes HTML.

Navigate using attacker-controlled message data.

Parse hostile JSON from a message into dangerous sinks.

Send users to an external URL via client-side logic.

Write attacker data into document.cookie.

Clobber globals so a later sink executes script.

Use clobbering to sneak past sanitizer assumptions.

Read an API using Origin: null from a sandboxed frame.

Abuse an allowlist that accepts http:// attacker hosts.

Declare an external entity that points at a file path.

Make the XML parser fetch an internal HTTP resource.

Detect XXE via an out-of-band DNS/HTTP hit.

Use parameter entities when general entities are blocked.

Host a DTD that sends file contents OOB.

Force parser errors that echo file contents.

Use XInclude when DOCTYPE is blocked.

Upload a crafted SVG/XML that the server parses.

Abuse a local DTD already on the server.

Reach an internal service that is not localhost.

Prove the server fetches your collaborator URL.

Bypass blocked hostnames with alternate encodings.

Bounce through an allowed redirect to an internal URL.

Hit a CGI endpoint vulnerable to Shellshock via SSRF.

Satisfy a hostname allowlist while still hitting internal targets.

Spot TE.CL using mismatched responses.

Hide a request the edge would have blocked.

Deliver a privileged request via TE.CL.

Observe how the proxy rewrites absolute-form requests.

Poison the queue so victim requests land in your lab.

Prefix a victim request with a reflected XSS prefix.

Desync HTTP/2 front-end with TE back-end.

Conflict HTTP/2 framing with Content-Length.

Inject CRLF sequences into HTTP/2 headers.

Split one client request into two backend requests.

Exploit a zero Content-Length desync case.

Abuse CL.0 parser disagreement.

Demonstrate a minimal CL.TE lab solve.

Demonstrate a minimal TE.CL lab solve.

Hide TE from one parser but not the other.

Store a poisoned response via a desync.

Make a cache store a private response as static.

Reach an internal route via H2 tunnelling.

Combine H2 tunnelling with cache poisoning.

Desync the browser connection itself.

Exploit timing pauses between request parts.

Append a second command to a ping/stock checker.

Prove injection using sleep/ping timing.

Write command output into a web-readable path.

Trigger a DNS/HTTP callback from the OS.

Exfiltrate file contents over DNS/HTTP.

Evaluate a math expression in a template field.

Break out of a template expression already in code.

Identify the engine and apply a documented payload.

Fingerprint then exploit with a known payload.

Dump template objects supplied by the app.

Escape a restricted template sandbox.

Build an exploit when stock payloads fail.

Reach /etc/passwd when relative ../ is blocked.

Double-encode or nest sequences past a single strip.

Bypass filters with nested encoding.

Satisfy a required prefix then climb out.

Truncate a forced extension with %00.

Browse to an admin route with no auth check.

Find an obscure admin path that still lacks auth.

Flip a role query/body field to admin.

Change your own role through a profile update.

Swap uid to another account’s data.

Collect another GUID and request their object.

Catch another user’s data in a redirect response.

Retrieve another account including password hash/plaintext.

Open another user’s message by changing its id.

Reach a restricted path via alternate routing.

Use an unexpected HTTP method to skip a check.

Skip ahead to a privileged step in a multi-page flow.

Forge a Referer the server treats as authorization.

Tell valid users apart from the error text.

Skip the OTP step by jumping to a post-auth URL.

Reset another user’s password by tweaking parameters.

Spot tiny timing/content differences.

Measure response times to find valid accounts.

Bypass a lockout that only keys on IP.

Lock responses reveal whether a user exists.

Verify OTP in the wrong account context.

Offline/online attack a predictable remember-me value.

Crack a leaked hash from the app.

Poison Host/X-Forwarded-Host on reset.

Abuse change-password to guess the current password.

Send many password guesses in one payload.

Automate OTP guessing when rate limits are weak.

Edit a live WS message to escalate privileges.

Attach a victim’s cookies to a cross-site WS.

Tamper handshake headers to reach a privileged channel.

Inject a header the cache does not vary on.

Vary responses using a cookie excluded from the key.

Combine several unkeyed inputs for a stable poison.

Discover a proprietary header that influences HTML.

Change a query the cache ignores in its key.

Find a parameter excluded from the cache key.

Hide a keyed param from the cache key parser.

Send a body on GET that the origin honors.

Abuse path normalization differences.

Get a DOM payload cached despite strict rules.

Chain unkeyed inputs for a reliable hit.

Inject delimiters into the cache key itself.

Poison a cache only visible on an internal tier.

Flip an admin boolean inside a serialized blob.

Change types to bypass comparisons.

Use a legitimate import/export path to run gadgets.

Instantiate a gadget class via PHP unserialize.

Trigger a Commons Collections gadget.

Use a documented PHP gadget chain.

Exploit a documented Ruby marshal/YAML chain.

Build a chain when public gadgets are blocked.

Develop an app-specific PHP POP chain.

Trigger unserialize via a phar:// wrapper.

Trigger an error that leaks a sensitive string.

Find a debug/status endpoint left enabled.

Download a backup that contains credentials.

Use disclosed data to skip authentication.

Recover secrets from an exposed .git directory.

Tamper prices or roles that are only checked in the browser.

Buy an item using an unintended high-level flow.

Reach a privileged action on one endpoint but not another.

Violate a coupon/limit rule the UI claims to enforce.

Abuse integer overflow / negative quantities.

Send unexpected types that skip validation.

Reuse an endpoint for a higher privilege action.

Skip confirmation steps in a purchase flow.

Jump states to become authenticated.

Manufacture credit through a refund/buy loop.

Abuse an encrypt/decrypt feature to forge tokens.

Use tricky email forms to confuse access checks.

Inject an attacker Host into the reset email link.

Access an internal admin by spoofing Host.

Send conflicting host-like headers.

Make the edge route your request internally.

Exploit parser differences on absolute URLs.

Reuse a connection after Host checks pass.

Steal a reset token with dangling markup + Host tricks.

Abuse implicit tokens delivered to the browser.

Register a client that makes the IdP fetch your URL.

Link an attacker IdP account to a victim.

Steal the code/token with an open redirect_uri.

Bounce an OAuth redirect through an open redirect.

Host a page that extracts tokens from redirects.

Upload a simple server-side script and execute it.

Send an allowed Content-Type with a dangerous body.

Traverse out of the uploads folder when saving.

Use an alternate extension the blacklist missed.

Trick extension parsing with odd capitalization/encoding.

Craft a file that is both a valid image and code.

Hit the file before an async antivirus deletes it.

Edit claims when the signature is ignored.

Bypass a buggy verify implementation.

Brute a weak HMAC secret and forge admin.

Embed your own JWK the server trusts.

Point jku at an attacker-controlled JWK set.

Make kid read a predictable file as the HMAC key.

Verify an RS256 key as HS256 with the public key.

Recover/derive material needed for confusion.

Use focused checks instead of noisy full scans.

Find bugs in JSON/GraphQL/custom encodings.

Pollute Object.prototype through a merge API.

Turn pollution into a DOM XSS sink hit.

Find a second gadget when the first is blocked.

Bypass a filter that blocks __proto__ naively.

Abuse a vulnerable client library merge.

Escalate roles via polluted server objects.

Blindly detect pollution gadgets.

Encode around blocked prototype keys.

Reach a dangerous sink after pollution.

Leak secrets through a pollution gadget.

Query posts that should be authorization-gated.

Request fields missing from the public schema docs.

Discover an alternate /graphql path.

Alias-batch login attempts in one request.

Forge a cross-site GraphQL state change.

Send parallel attempts before counters update.

Hit two endpoints that share unsafe state.

Parallelize one endpoint to corrupt state.

Win a narrow timing window in validation.

Use an object before initialization finishes.

Confirm operator injection in a JSON login.

Bypass login with $ne / $gt style operators.

Enumerate fields with operators.

Discover hidden document keys.

Find a privileged operation documented but unprotected.

Inject extra params the backend misparses.

Call a legacy endpoint still wired to production.

Send privileged fields the binder accepts.

Pollute path parameters server-side.

Convince a tool-using LLM to take a privileged action.

Abuse model/tool endpoints directly.

Plant instructions in retrieved content.

Turn model output into XSS/SSTI/RCE in the app.

Trick an agent into deleting or wiping data.

Coax an agent to send secrets outbound.

Use the agent as a confused deputy into XSS/SSRF.

Smuggle content past an LLM safety/scanner layer.

Map a private path onto a cacheable static suffix.

Abuse ; or similar delimiters vs cache rules.

Mismatch origin normalization vs cache key.

Exploit how the cache normalizes paths.

Beat exact-match rules with subtle path variants.