Progress

16 / 17 flags captured (this session).

WEB 001 CSRF ✅

WEB 002 Password reset ✅

WEB 003 Captcha bypass ✅

WEB 004 JWT attacks ✅

WEB 005 Broken Access Control ✅

WEB 005B IDOR ✅

WEB 006 Clickjacking ⬜

WEB 007 Reflected XSS ✅

WEB 009 Stored XSS ✅

WEB 008 DOM XSS ⬜

WEB 011 SSTI (Jinja) ✅

WEB 012 CSTI (Angular) ✅

WEB 013 Mutation XSS ✅

WEB 014 Business logic ⬜

WEB 015 HTTP Param Pollution ✅

WEB 016 Content discovery ✅

WEB 017 LFI / path traversal ✅

CWAP Prep Labs · HackXpert Coaching · The XSS Rat · authorized lab use only