🧪 CyberLab training instance. Intentionally vulnerable. Simulated only — there is no real shell, no real network access, and no host data behind these bugs.

Lab Status

Your private scorecard, refreshed live against the class. connecting…

Your scorecard

… — 0 of 18 captured.

Give yourself a name so the class board can show you.

Class progress

—

Everyone attacking this instance. Auto-refreshes every 4 seconds.

Your challenges

	Challenge	Category	Tier	Flag
⬜	SQL Injection	Injection	intermediate	—	open
⬜	Reflected XSS	XSS	beginner	—	open
⬜	Stored XSS	XSS	intermediate	—	open
⬜	IDOR	Access Control	beginner	—	open
⬜	Broken Authentication	Authentication	beginner	—	open
⬜	Path Traversal	Files	beginner	—	open
⬜	Command Injection	Injection	intermediate	—	open
⬜	SSRF	Injection	intermediate	—	open
⬜	Broken Access Control	Access Control	intermediate	—	open
⬜	Unrestricted File Upload	Files	beginner	—	open
⬜	Blind SQL Injection	Injection	advanced	—	open
⬜	Mass Assignment	Access Control	advanced	—	open
⬜	XML External Entity (XXE)	Injection	advanced	—	open
⬜	Server-Side Template Injection	Injection	advanced	—	open
⬜	Open Redirect	Client-Side	beginner	—	open
⬜	CRLF Injection	Injection	intermediate	—	open
⬜	Insecure Deserialization	Injection	intermediate	—	open
⬜	Encoded Path Traversal	Files	advanced	—	open

Class leaderboard

#	Student	Captured	Progress
Waiting for the class…

Rules of engagement

This is a sandbox. Everything here is fake and isolated.
Attack the app only — do not attack the host, other services, or the network.
No denial-of-service, no brute-forcing outside the intended challenges.