Modules

Access other users' data by manipulating object identifiers in requests. A great first vulnerability to understand broken access control.

Bypass authentication using classic SQL injection techniques. Learn how unsanitized inputs can break an entire login system.

Access restricted files on the server using path traversal payloads. Understand how file system boundaries can be broken.

Craft and execute reflected cross-site scripting attacks. Learn how malicious scripts get injected into a victim's browser.

Extract database contents using UNION-based SQL injection. Go beyond login bypass and pull real data from the backend.

Inject persistent malicious scripts into application storage. Unlike reflected XSS, stored payloads hit every user who loads the page.

Force authenticated users to perform actions without their knowledge. Learn how to exploit missing CSRF protections.

Execute arbitrary system commands through unsanitized user input. One of the most dangerous vulnerability classes in web apps.