GovDesk

The intention

You're on a scoped one-day assessment of GovDesk, an e-government services portal handling citizen PII and case files. No flags — find and exploit every critical issue (PII/BOLA breach, RCE, auth bypass), assess impact, and deliver a plan and report.

How it runs

1. Qualify (50 MCQ, 70% to pass). Prove you know the CWAP material before you touch a live target. Score under 70% and you can't start.
2. Plan (90 min). You must write and submit a pentest plan before the target unlocks — exactly like a real engagement. No plan, no access.
3. Hack (24 h). Once your plan is in, the clock starts: you have 24 hours to compromise the target and identify every critical issue.
4. Report & debrief. Write up your findings, then watch the hidden debrief video where the intended attack paths are walked.

There are no flags. Your deliverable is the plan and the report — the skills a real assessment demands.

🎓 CMWAP practice. This mirrors the CMWAP exam (Certified Modern Web App Pentester): a 24-hour window, a written report, and a ≤10-minute debrief video scored on your methodology. Treat it like the real thing.