Progress

0 / 15 bug classes captured (this session).

Capture all 15 bug classes to reveal the final flag.

⬜ JWT weak secret / alg-none

⬜ IDOR (ticket)

⬜ Broken access control

⬜ CSRF (change email)

⬜ Reset host-header poison

⬜ Captcha bypass

⬜ Reflected XSS

⬜ Stored XSS

⬜ DOM XSS

⬜ SSTI (RCE)

⬜ Business logic (coupon)

⬜ HTTP parameter pollution

⬜ Content discovery

⬜ LFI / traversal

⬜ Clickjacking