The modern identity-attack range

Learn auth by breaking it.

Hands-on labs for the attacks that actually take over accounts — JWT forgery, OAuth theft, SAML wrapping, MFA bypass, session fixation, credential stuffing. Every lab is sandboxed, in-browser, and ends with the fix.

Start hacking →Explore the wiki

7live labs

20techniques

100%in-browser

attack — jwt-alg-none

$ curl -s /api/lab/jwt-alg-none/attack/admin \
  -H 'Authorization: Bearer …'
     eyJhbGciOiJub25lIn0.eyJyb2xlIjoiYWRtaW4ifQ.

→ 200 OK
  message: Welcome, administrator.
  flag:    ATK{f3a9···2b}

Start hacking

Create an account to track progress, earn points, and climb the scoreboard.

What you'll attack

Seven attack classes, each a sandboxed lab with a flag and a fix.

Token Forgery

Abuse the alg header — alg:none and RS256→HS256 confusion.

redirect_uri Abuse

Steal authorization codes via loose redirect validation.

Signature Wrapping

Forge SSO assertions a presence-only check accepts.

Fixation & Hijacking

Ride sessions that never rotate at the login boundary.

Second-Factor Bypass

Tamper verify requests, skip steps, passkey pitfalls.

Reset Poisoning

Poison links via the Host header; predict weak tokens.

Stuffing & Enumeration

No rate limit plus chatty errors equals takeover.