Each lab below is an ORDERED chain: entry → pivot → impact. Nodes light up as you reach each objective; the app enforces the preconditions, so there is no shortcut. 0 / 17 nodes reached this session.
Mini-chains
Leak → IDOR
An info leak exposes a victim's object ref; an IDOR on that ref reads their private data.
⬜
ENTRY - Info leak: a public activity feed over-shares a victim's opaque object ref
↓
⬜
PIVOT - IDOR: read the victim's private record by that leaked ref
↓
⬜
COMPLETE - private data read via a ref you were never meant to have
XSS → steals CSRF token
A reflected XSS in the app's own origin reads the anti-CSRF token out of the DOM, enabling a forged state-change.
⬜
ENTRY - Reflected XSS in the app origin (proved via an in-app /api/solve callback)
↓
⬜
PIVOT - Same-origin script reads the CSRF token and forges the protected state-change
↓
⬜
COMPLETE - a CSRF-protected action performed with a stolen token
Open redirect → token theft
An open redirect on the login return flow forwards the freshly-issued session token to an attacker destination.
⬜
ENTRY - Open redirect: login trusts `next`, forwarding the fresh session token off-site
↓
⬜
PIVOT - Attacker replays the leaked token to authenticate as the victim
↓
⬜
COMPLETE - account access from a token stolen via the redirect
Methodology: own-the-app
⬜
ENTRY - Info disclosure: the team directory / stats feed leaks internal uids + account refs
↓
⬜
PIVOT A - IDOR/BOLA: read the admin account by its leaked ref (reveals the admin email)
↓
⬜
PIVOT B1 - Predictable reset: the admin's reset token is a pure function of its email
↓
⬜
PIVOT B2 - JWT forge: crack the weak HS256 secret and mint role:admin for the enumerated admin uid
↓
⬜
IMPACT - Role-checked admin action: transfer workspace ownership