🖥️ Cyber Range — live scenarios

A login form that builds its query by string-concatenation. Authenticate without a password and the dashboard hands you the flag.

An account-statement endpoint trusts the id in the URL with no ownership check. Walk the ids to read an account that isn't yours — it holds the flag.

The API hands you a signed JWT and verifies it insecurely. Forge an admin token with alg:none and call the admin endpoint to read the flag.

An operator HMI for a water-treatment plant exposes engineering controls with no real authorisation — just a role in the URL. Escalate to engineer, bypass the safety interlock, and the control room hands you the flag. Models an exposed ICS/OT control surface.

A power-substation operator console shipped with vendor default credentials that were never changed — a classic ICS foothold. Log in with the factory account and the console hands you the flag.

A hospital patient portal loads records by medical-record number with no ownership check. Walk to a restricted patient's record — the clinical note holds the flag. Real-world Kenya DPA / HIPAA exposure.

A subscriber self-service portal updates your profile from the fields you send — including ones the UI never shows. Over-post your role to authorise a SIM swap you shouldn't be able to. Models real SIM-swap fraud.

An airline 'manage my booking' page loads any reservation by its record locator (PNR) with no identity check. Walk to another passenger's booking — a restricted crew record holds the flag, passport and all.

A government permit portal parses uploaded XML with external entities enabled. Declare an entity that reads a server-side file and echo it back through your application — the intake receipt leaks the flag. Classic XXE.

A student-records lookup builds its SQL by string concatenation. Inject to dump records you shouldn't see — a sealed disciplinary record carries the flag.

A claims portal trusts the approval status and payout amount the browser sends. Approve your own claim — or push the payout past the policy cap — and the settlement letter leaks the flag.

An online-shop checkout trusts the quantity and price the browser sends. Bend the maths — a negative quantity or a tampered price — until the order total drops to zero or below, and checkout comps you the flag.

A marketing tool renders your greeting through a server-side template engine. Prove injection with {{7*7}}, then reach into the server context to read the secret that holds the flag. Classic SSTI.

A live diagnostics tool that pipes your input into a shell. Chain a command, read the flag file on the box, and submit your unique NB{…}.

A document viewer joins your filename onto a base path with no sanitisation. Traverse out of the docs folder to read the secret flag file.

A link-preview fetcher that calls any URL from the server. Point it at the internal-only metadata service to make it leak the flag.

Submit a support ticket; an automated 'agent' opens it moments later. Land a stored XSS that fires in the agent's browser and exfiltrates the flag from their session.

A login with no lockout and a weak password. Brute-force the admin account (the password is a common one) and the panel reveals the flag.

A realistic mini-engagement: the only flag is behind the admin panel. Leak the app's config via path traversal, recover the admin's DB password, then log in. Three steps, one flag.