BeginnerWeb Security
Understanding SQL Injection
See how unparameterized queries break trust boundaries, then rebuild the endpoint with prepared statements.
45 min 120 pts
Start Lab Labs
Practice safely in isolated environments
Each lab pairs a deliberately weak demo application with the remediation work that closes the gap.
Only use these labs for authorized educational testing.
All labs
BeginnerInput Validation
Cross-Site Scripting Fundamentals
Understand stored, reflected and DOM sinks in a sandboxed app, then apply contextual output encoding.
40 min 110 pts
Start Lab IntermediateAuthentication
Authentication Security
Review a demo login flow for weak hashing, session fixation and unsafe recovery, then harden each step.
60 min 180 pts
Start Lab IntermediateAuthentication
Access Control Concepts
Work through object-level authorization on a demo API and implement server-side ownership checks.
50 min 160 pts
Start Lab IntermediateAPI Security
Secure API Validation
Add schema validation, type coercion safety and rate limits to a deliberately permissive demo API.
45 min 150 pts
Start Lab BeginnerSecurity Headers
Security Headers Lab
Configure CSP, HSTS, frame protections and referrer policy, and measure the effect on a demo site.
30 min 90 pts
Start Lab BeginnerInput Validation
Input Sanitization Lab
Compare allow-list validation with sanitization and learn where each belongs in a request pipeline.
35 min 100 pts
Start Lab AdvancedConfiguration Security
Configuration Hardening
Harden a demo deployment: secrets management, permissions, logging and default-deny networking.
70 min 220 pts
Start Lab AdvancedCryptography Concepts
Cryptography Concepts
Hashing vs encryption, key rotation and authenticated encryption explained through safe exercises.
65 min 200 pts
Start Lab