Labs
Hands-on authentication attack labs. Sign in to start solving and track progress.
JWT alg:none Authentication Bypass
Forge a JSON Web Token by abusing the unverified `alg` header to escalate from a normal user to administrator.
Credential Stuffing & Username Enumeration
Distinct error messages leak which usernames exist, and there's no rate limiting — stuff a leaked password list to take over an account.
MFA Bypass via Request Tampering
Bypass a second factor whose verification trusts a client-supplied field instead of checking the real OTP.
Session Fixation
Fix a victim's session id, have them authenticate, then ride the now-privileged session — because the app never rotates the id on login.
OAuth redirect_uri Abuse
Steal an OAuth authorization code by abusing loose redirect_uri validation, then exchange it for a token.
Password Reset Poisoning (Host header)
Poison a password-reset link via the Host header to capture a victim's reset token and take over the account.
SAML Signature Exclusion
Tamper a SAML assertion the IdP signed, exploiting an ACS that checks a signature is present but never that it covers the assertion.