Free interactive security labs

Practise SQL injection, XSS, IDOR, JWT forgery, SSRF, XXE, path traversal, log analysis and more — safe, simulated, and entirely in your browser.

  • Terminal Simulator — A safe, in-browser Linux terminal with a fake filesystem. Practice ls, cd, cat, grep, find, whoami and more without spinning up a VM.
  • Vulnerable Web App — A tiny deliberately-broken app for practicing XSS and login-bypass. Runs entirely in-browser; no server to attack, nothing to install.
  • SQL Injection Sandbox — A fake login backed by a simulated database. Watch your input become SQL, then bypass the login with a classic injection.
  • Phishing Spotter — Real email or phish? Call each one, then see the exact red flags you spotted (or missed). Trains the instinct that stops most attacks.
  • Packet Capture Viewer — Load a sample capture and explore protocols, IPs, and payloads — the same "read the traffic" muscle Wireshark builds.
  • IDOR Playground — A fake "my invoices" page. Change one number in the URL and see whose data you were never supposed to see.
  • JWT Forgery Lab — Tamper with a JSON Web Token — strip the signature, flip a claim, and watch a vulnerable "verify" endpoint accept it anyway.
  • Path Traversal Playground — A fake "view file" feature that trusts the filename you give it. Climb out of the intended folder with ../ and read files you shouldn't.
  • SSRF Playground — A "fetch this URL for me" feature with no allowlist. Point it at internal-looking addresses and see what it leaks.
  • XXE Playground — An XML upload feature that expands external entities. Smuggle a local file read through a "harmless" XML document.
  • Log Analysis / IR Lab — A messy auth.log dump from a compromised box. Reconstruct the timeline and find the breach — blue-team skills, not exploitation.
  • OSINT Sandbox — A safe, fake company profile — practise open-source recon technique without touching anything real.
  • BOLA/BFLA Playground — A fake employee-directory API. Read a record that isn't yours, then call an admin-only action with no admin role at all.
  • GraphQL Introspection Abuse — A single /graphql endpoint. Use introspection to map the full schema, then query a field the UI never shows you.
  • Mass Assignment Toy — A "update my profile" endpoint that binds whatever JSON you send straight to your account. Find the field that shouldn't be writable.
  • Rate-Limit Bypass Simulator — A login endpoint that blocks you after 3 bad guesses — but trusts a header you control to decide who "you" are.
  • Prompt Injection Simulator — Chat with a support bot that's told to never reveal its system prompt. Get it to reveal it anyway.
  • Jailbreak Playground — An assistant refuses to share a secret code directly. Find a roleplay or hypothetical framing that gets it to comply anyway.
  • Indirect Prompt Injection Challenge — You control a job posting an AI assistant is about to summarize for someone else. Plant an instruction it'll follow instead.
  • Agentic Risk Scenario — An AI agent with email tool-access is about to process an inbox. Spot and quarantine the malicious email before it acts on it.
  • Active Directory Attack Lab — A guided walkthrough of BloodHound-style graph recon, Kerberoasting a weak service account, and forging a Golden Ticket.
  • CSRF Playground — A "bank" transfer endpoint trusts your cookie alone. Watch a malicious page forge a request on your behalf, then see a CSRF token stop it cold.
  • Command Injection Sandbox — A "ping this host" tool glues your input into a real shell command. Chain a second command onto the intended one.
  • Open Redirect Playground — A login page trusts a returnUrl parameter completely. Turn a genuinely trusted link into a post-login phishing weapon.
  • Clickjacking Simulator — An invisible iframe sits on top of a fake game button. See exactly how a real click lands on a hidden "delete account" button instead.
  • Insecure Deserialization Toy — A "remember me" cookie is a trusted, deserialized object. Add one field to grant yourself admin with zero login.
  • Subdomain Takeover Simulator — Five DNS records, one dangling CNAME pointing at a deleted third-party resource. Find it before someone else claims it.
  • DNS Recon Playground — A simulated dig. Query a target's likely subdomains and build a map of its real, sometimes-forgotten attack surface.
  • Windows Privesc Playground — A misconfigured service runs as SYSTEM with a writable binary path. Replace it and escalate — no exploit needed.
  • Linux Privesc Playground — Enumerate SUID binaries on a simulated box and find the one GTFOBins turns straight into a root shell.
  • Kerberoasting Simulator — Request a service ticket for a weak-password service account, then crack the offline-crackable hash it hands you.
  • Cloud IAM Misconfig Playground — A role holds one deceptively small permission. Chain it into full account takeover through iam:PassRole.
  • Docker Escape Playground — A container mounts the host's Docker socket. Use it to spin up a privileged container and step onto the host itself.
  • Malware Strings Triage Lab — A raw strings dump from a suspicious binary. Spot the IOCs — a C2 domain, a mutex, a registry key — before touching a disassembler.
  • YARA Rule Builder Challenge — Three malware samples, one clean file. Write a YARA rule that matches every sample and nothing else.
  • Race Condition Lab — A one-time coupon, redeemed with a check-then-act flaw. Fire requests fast enough and redeem it far more than once.
  • Webhook Signature Forgery Lab — Forge an HMAC-signed webhook without the secret, then flip on signature verification and watch it get rejected.
  • OAuth Redirect URI Hijack Lab — An authorization server validates redirect_uri loosely. Steal an authorization code by redirecting it to your own endpoint.
  • Vendor Risk Tiering Simulator — Six vendors, six very different data-access levels. Tier them correctly and decide who needs a full security review.
  • Incident Response Tabletop — A branching ransomware scenario. Make the containment and communication calls a real incident commander has to make under pressure.
  • Password Cracking Lab — Four hashed passwords, one wordlist. See exactly which ones fall to a dictionary attack and which survive it — and why.
  • Leaked Secret Hunt — A public GitHub repo dump. Find the hardcoded API key an automated scanner would catch in minutes — before an attacker does.