Hacking Labs

137 hands-on labs + 75 AI-generated puzzles across 13 domains — web, AD, cloud, mobile, network, crypto, forensics, OSINT, RE, DevSecOps, AI/ML, hardware & blockchain. Capture the flag, earn XP.

// domain

New to hacking? Start with a Learning Path.

open academy

13 domains·137 labs·6 career tracks·capstone exams·real CVEs

open academy

// filter by

JWT alg=none

A login endpoint mints JWTs but trusts the `alg` header. Forge an admin token and read the flag.

medium+40xp

authINTERACTIVEmedium+40 XP

Insecure Direct Object Reference

A profile endpoint trusts the `user_id` query param with no auth check. Read someone else's profile.

easy+25xp

authINTERACTIVEeasy+25 XP

Cookie Forgery via Missing Signature

The session cookie is base64(JSON). Tamper your role to admin — and the server forgets to verify the signature.

medium+40xp

authINTERACTIVEmedium+40 XP