Prove it. Solve it.
Get certified.
Two tracks of realistic labs. Each challenge opens its own page — the page is the vulnerable website, so your payload executes exactly as it would against the real target. Everything runs safely in your browser; the "attacker server" is a log on the page.
Make a page run your code in someone else's browser.
Spot the reflection and fire your first payload — no filters in the way.
HackerMart's product search echoes whatever you search for straight back onto the page. That's normal — the question is whether it comes back as text or as live code. Use the search box (watch the address bar update), and then try navigating to a crafted URL yourself.
HackerMart heard about the last finding and added a quick fix: they now strip the literal word `<script>` from search input. Most payloads are dead on arrival… but only the ones they thought of.
Filters appear, and the attack moves into the database and the DOM.
HackerMart runs a public guestbook. Whatever you post is saved on the server and shown to every visitor — including the site admin, who checks in periodically. Post something that only misbehaves when the admin is looking.
HackerMart's search is a single-page app: the results route is driven by the URL hash — `#/search?q=<your text>`. The page never sends your input to the server at all. JavaScript reads the hash and writes it into the page. The server is innocent; the browser-side code is the problem. Try it in the address bar.
The admin of HackerMart is logged in. Their session cookie identifies them — and any script running on the site can read it. Post a guestbook comment that phones the admin's cookie home to your 'attacker server' when they visit.
Evade a sanitizer and chain the whole attack into a session hijack.
HackerMart finally deployed a 'sanitizer'. It strips `<script>` and removes any `onerror=` attribute. Surely this time they're safe… unless you find the gap between what the filter removes and what the browser executes.
The full chain. HackerMart's admin is logged in with a session cookie. 1) Plant a stored payload in the guestbook. 2) When the admin visits, it steals their cookie to your attacker panel. 3) Use the stolen cookie to hijack the admin's session — paste it into the hijack form. That's a complete XSS-based account takeover.
Abuse XML parsers to read files and reach internal systems.
Understand the XML machinery — DOCTYPE, DTD, entities — then make the parser obey you.
DropZone is a developer tool that pretty-prints XML documents. Paste XML in, get a tidy tree out. Under the hood the preview runs every XML you give it through its parser — including any DOCTYPE and entities you declare. Start by learning how XML entities work, then make the app resolve one of your own.
DropZone added a 'preview rendered' tab: paste XML, and the page renders any text element as visible content. The XML parser they use still processes external entities. A classic XXE trick reads a file by pointing an external entity at it and letting the app echo the file's contents back — try the platform's own filesystem first.
File uploads and document converters start trusting your XML.
DropZone lets members upload a profile picture. They accept PNG, JPG… and SVG, because 'it's just an image'. The upload handler parses every SVG on the server to check it's valid (dimensions, size) — and that parser processes external entities. An SVG is XML, so a picture can carry a DOCTYPE.
DropZone's flagship feature: upload a Word document (.docx) or an XML file and it converts it to PDF or plain text. A .docx is a ZIP of XML files, and the conversion engine parses every one of them. It also supports XML uploads directly for 'spreadsheet import'. The converter needs to read files on the server to work — so it has file access built in.
Bypass input validation and chain XXE into blind exfiltration and SSRF.
DropZone patched the avatar upload after the last report — the validator now rejects SVGs whose DOCTYPE mentions SYSTEM or any file path. But it still accepts SVG files, and the parser still expands external entities. You can't read a file back in the response anymore… so make the server send it somewhere you're listening.
The full chain. DropZone's converter has file access and its internal network has an administration service: a 'members API' at http://10.0.0.12/export that dumps customer records (PII) for the internal staff dashboard. The converter will happily make HTTP requests on your behalf — an external entity pointing at an http:// URL is just a request the server makes for you (SSRF). Combine file reading and SSRF to pull the member list out through the converter.