Solve a real security mission, right in your browser.
Pick a mission below and play the real thing: inspect evidence, use the tools, and submit your finding. Everything runs in a safe, simulated environment. Guest progress is not saved.
Web Application
Reading an Intercepted Request
Starter mission: Acme Retail's order history page loads order details from its API. You have positioned a proxy between your browser and the API so every request and response passes through a tool you control before it reaches the network. The proxy has captured one exchange: a logged-in shopper opening their own order confirmation page. Before you can test anything, you need to read the raw request and response the way the server actually sees them, not the polished page the browser renders.
Play missionWeb Application
SQL Injection Login Bypass
Starter mission: ShopDesk's staff portal signs an employee in by checking a username and password pair against the accounts table. You captured the login request in your proxy tools and want to see whether a crafted username can change how the server decides who gets in, without ever knowing a real password.
Play missionWeb Application
Reflected Cross-Site Scripting in a Search Page
Starter mission: AcmeForum's public search page takes a query string and writes it straight back into the results heading so visitors can see what they searched for. You are reviewing the endpoint through a proxy. The search box is open to anyone, logged in or not, and nothing on the request path modifies or checks the query value before it lands in the response body.
Play missionWeb Application
IDOR on a Numeric Invoice Reference
Starter mission: Acme Retail's billing portal lets a logged-in customer download their own invoices as a PDF by visiting a URL that includes a numeric invoice_id. You are logged in as one customer and captured the request your own download link sends. The invoice IDs look sequential, so through the proxy you resend the same request with a nearby number instead of your own.
Play missionSafe simulated missions: no live targets, no tooling to install. Guest progress isn't saved.