Hard Lab Catalogue

Only Hard and Expert challenges are included. Expert labs require Elite.

Hard

Chained IDOR Across Account Resources

Pivot through multiple predictable object references to reach a protected record.

Access Control · 75 min · 450 XP

🔒 Pro required
Hard

JWT Verification Logic Failure

Analyze token verification behavior and identify unsafe trust assumptions.

JWT · 75 min · 500 XP

🔒 Pro required
Hard

OAuth Account-Linking Logic

Find a broken account-linking decision in a simulated OAuth callback.

OAuth · 90 min · 550 XP

🔒 Pro required
Hard

Race Condition in Credit Ledger

Exploit a simulated concurrency flaw in a training credit ledger.

Business Logic · 90 min · 600 XP

🔒 Pro required
Hard

SSRF URL Parser Confusion

Bypass a simulated URL allowlist using parser normalization differences.

SSRF · 90 min · 600 XP

🔒 Pro required
Hard

GraphQL Nested Object Authorization

Reach another tenant record through nested GraphQL-style object resolution.

API Security · 80 min · 500 XP

🔒 Pro required
Expert

Unsafe Deserialization Trust Boundary

Analyze a simulated serialized object trust failure.

Application Security · 120 min · 800 XP

🔒 Elite required
Expert

Cache Key / Routing Confusion

Manipulate a simulated cache-key discrepancy to surface protected content.

Web Infrastructure · 120 min · 850 XP

🔒 Elite required
Expert

SAML Identity Binding Failure

Analyze a simulated SAML consumer that binds the wrong identity attribute.

SAML · 120 min · 900 XP

🔒 Elite required
Expert

Multi-Tenant Export Authorization Chain

Chain tenant switching and export authorization mistakes.

Access Control · 135 min · 950 XP

🔒 Elite required