Progress

0 / 34 exploits found (this session). Each working exploit is recorded automatically when you perform it - no flags to submit.

⬜ JWT weak secret / alg-none -> admin

⬜ SQL injection - login auth bypass

⬜ SQL injection - product search (UNION/error)

⬜ Reflected XSS - search term

⬜ Stored XSS - product review

⬜ DOM XSS - location.hash sink

⬜ IDOR - view another user's order

⬜ IDOR - download another user's invoice

⬜ Broken access control - /admin forced browse

⬜ Price manipulation - client-supplied price

⬜ Negative-quantity business logic

⬜ Coupon stacking - no single-use enforcement

⬜ Mass assignment - role/is_admin/credits

⬜ SSRF - import image / webhook -> internal metadata

⬜ XXE - product bulk XML import

⬜ Path traversal / LFI - invoice export

⬜ Open redirect - next/url parameter

⬜ CSRF - change shipping via state-changing GET

⬜ Host header poisoning - reset link

⬜ Predictable reset token - md5(email)[:12]

⬜ Client-side-only captcha bypass

⬜ HTTP parameter pollution - repeated sort

⬜ Content discovery - robots.txt ops panel

⬜ Clickjacking - no frame-ancestors

⬜ Command injection - carrier tracking

⬜ Insecure deserialization - saved cart pickle

⬜ Verbose error / info disclosure - /api/debug

⬜ CORS misconfig - Origin reflect + credentials

⬜ Unrestricted file upload - served back

⬜ User enumeration - login response differs

⬜ Weak/reversible crypto - base64 rewards token

⬜ Sensitive data exposure - key in /static/app.js

⬜ GraphQL introspection - leaks secret field

⬜ Sensitive cookie without HttpOnly