🎯 Hands-on labs

13 labs · sign in to launch

The full engagement. Minimal hints, full scoreboard.

🔒 Sign in required

A peek at the engagement

Here's the full set of hands-on labs you'll work through. Launching a lab, capturing flags and climbing the scoreboard all unlock once you sign in.

📋 The scenario

You're now Sentinel's lead on the HackYard account. This is the real assessment: all 13 flaws — including SSTI — scored, on the clock, against the leaderboard. Hints still exist, but the points and 🩸 first-bloods are what matter now. Own the app.

Every web challenge in HackYard is in scope. Capture all 13 flags, climb the leaderboard, and grab the first-blood bonuses where you can.

The labs — 13 hands-on flaws

💉

SQL injection (login bypass)

EasyA03 — Injection

🔓

IDOR — read any account

EasyA01 — Broken Access Control

📝

Stored XSS in support

EasyA03 — Injection (XSS)

🎫