Solve a real security mission, right in your browser.
Pick a mission below and play the real thing — inspect evidence, use the tools, and submit your finding. Everything runs in a safe, simulated environment. Create a free account afterward to save your progress.
easy
Web Application
Insecure Login
Starter mission: Review this sample login handler for an obvious flaw.
Play missioneasy
Web Application
SSRF Preview
Starter mission: A preview service fetches user-supplied URLs server-side.
Play missionmedium
Web Application
Proxy Trust Header
An API gateway forwards admin requests when a client sends x-internal=true.
Play missioneasy
Infrastructure & Cloud
Over-Privileged Service Account
Starter mission: AcmeCloud CI uses a service account with broad permissions.
Play missionSafe simulated missions — no live targets, no tooling to install. Guest progress isn't saved.