CWAP Prep Labs

Deliberately vulnerable labs mapped to the CxWAP WEB syllabus. Capture the flag{...} in each. Track them on the progress page.

WEB 001 CSRF
State-changing request with no anti-CSRF token or SameSite.

→ open lab

WEB 002 Password reset
The reset token is a predictable md5(email) - forge the admin's.

→ open lab

WEB 003 Captcha bypass
The captcha is validated client-side only.

→ open lab

WEB 004 JWT attacks
Weak HS256 secret / alg confusion - forge an admin token.

→ open lab

WEB 005 Broken Access Control
Admin console with no authorization check - just browse to it.

→ open lab

WEB 005B IDOR
Object id in the URL - walk it to read other users.

→ open lab

WEB 006 Clickjacking
Sensitive action fram-able (no frame-ancestors / XFO).

→ open lab

WEB 007 Reflected XSS
Query echoed into the page unencoded.

→ open lab

WEB 009 Stored XSS
Comment stored and served to every visitor.

→ open lab

WEB 008 DOM XSS
location.hash -> innerHTML, client side.

→ open lab

WEB 011 SSTI (Jinja)
Input concatenated into a server template -> RCE.

→ open lab

WEB 012 CSTI (Angular)
Input lands in an AngularJS-bound region.

→ open lab

WEB 013 Mutation XSS
Sanitize-then-innerHTML: the re-parse mutates it.

→ open lab

WEB 014 Business logic
Buy the flag item you can't afford - abuse the workflow.

→ open lab

WEB 015 HTTP Param Pollution
Duplicate params resolve inconsistently.

→ open lab

WEB 016 Content discovery
Wordlists/robots reveal a hidden panel.

→ open lab

WEB 017 LFI / path traversal
?page= includes a file - traverse out.

→ open lab

CWAP Prep Labs · HackXpert Coaching · The XSS Rat · authorized lab use only