Safe hacking labs
Practice in your browser. Nothing real is attacked.
Every vulnerability here is a full client-side simulation inside a sandboxed frame. No real SQL, no real shell, no logins. Long links are tidy unique URLs — not a secrecy boundary, since this page lists them.
SQL injection (fake login)
Learn how a login built with string glue can be tricked. All data is fake and stays in your browser.
- What SQL injection means in plain words
- How a quote can change a query
Reflected XSS
See how a search page that echoes your words as HTML can run unwanted script — only inside the sandbox.
- What reflected XSS is
- Why escaping matters
Stored XSS
Leave a comment that runs later when anyone views the list. Still only in this browser sandbox.
- Stored vs reflected
- Why user content is dangerous
IDOR (wrong object access)
Change an id in a fake API and read someone else's note. The bug is missing an ownership check.
- What IDOR means
- Why ids are not secrets
Broken auth (weak JWT)
A fake token checker accepts the dangerous alg=none trick. Forge an admin role — only here.
- What a JWT looks like
- Why alg=none is unsafe
Path traversal
A file viewer joins paths unsafely. Climb out of public/ with ../ in a fake file system.
- What ../ does
- Safe path joins
Command injection (fake ping)
A pretend ping panel builds a shell line from your host. Chain another command. No real shell runs.
- Why shell glue is dangerous
- Metacharacters ; && |
Need a real security review?
These labs are for learning. For paid work, reach Plixy on the main site.
Contact page