This catalog is a work in progress — I'm actively polishing it and adding new labs.
Catalog
Every lab is a self-contained Docker Compose stack that runs on your machine. Pick one, clone the repo, and docker compose up -d.
5 of 5 labs
Acme Corp's public marketing site, exactly as it ships. No login form to attack, no input field to fuzz — just a website, and the question of what else is sitting around it that nobody meant to leave reachable.
A small internal support-ticket portal for Acme Corp customers. You're given a low-privilege customer account — everything else you find is yours to discover, the same way you'd approach an in-scope target with a test account on a real program.
A link-unfurling feature — paste a URL, get a snippet back, the same category of feature that generates most real-world SSRF reports. Behind it sits a small internal network you were never given direct access to.
A small banking-style customer portal with two unrelated authentication bugs — one in how password resets are proven, one in how sessions are verified. Neither depends on the other.
A shared-notes app with a real support workflow: report a broken link and a support bot reviews it in a real browser, logged in as an admin. What you do with that is up to you.