WEBVERSE

Loading...

The Challenges

Short, sharp targets. One flag each. Every challenge teaches a single vulnerability class against a believable fictional app.

Showing 1–9 of 122 challenges
easy
mfa

Self-Checkout

Cartwell Market's Scan and Go app locks your account behind a one-time code texted to your phone at sign in. Create an account, reach the verification step, and see whether that second factor really holds.

medium
csrf

Billed

Billed is a small personal expense tracker. Anyone can sign up, but the account worth having belongs to the operator who reads the contact inbox. Get into the operations console.

medium
dom-xss

Rexigon

A shop that sells collectible toy dinosaurs, grouped into five sets. The whole catalogue lives on one long page, so each set has a share-friendly deep link that jumps you straight to it once the page loads, all handled in your browser.

medium
dom-xss

DirtOil

A flower-seed and garden-supply shop. It writes up its own growing guides and routes every guide click through a tidy handoff page that runs entirely in your browser.

medium
deserialization

Almanac

Almanac is a private journaling app, write dated entries, keep your photos, and carry the whole archive between devices. The catch is the "carry it across" part: exporting your capsule and importing it on another device are two halves of the same trusting handshake.

medium
deserialization

Cookbook

A recipe manager and meal planner. You can export any recipe to a portable backup and import it on another device, and the restore step trusts the backup a little too much.

medium
deserialization

Knockdown

A maker community for flat-pack furniture. Every build exports to one portable file you can share, and anyone can paste that file back in to restore the whole design, cut list, hardware, and the rendered preview, exactly as it shipped.

easy
deserialization

TicketSeason

A verified hockey-ticket marketplace that keeps you signed in between visits by stashing your account in a "remember me" cookie. The box office trusts whatever it finds in there.

medium
sqli

DropCall

Wilderness Permits' search was rebuilt in 2023 with a deliberately minimal failure surface. Minimal is not the same as silent.