An interactive training ground to explore modern web vulnerabilities.
View the C2 server logs to see if any cookies or data have been exfiltrated.
Launch LabSimulate a Man-in-the-Browser attack by injecting JS into the login page via DevTools.
Launch LabBypass SameSite=Lax cookie protection using a compromised but same-site subdomain.
Launch LabTest how browsers handle automatic downloads initiated from a cross-origin iframe.
Launch LabExplore browser permissions and user gestures required for clipboard access.
Launch LabExploit `window.opener` to perform a phishing attack on the previous tab.
Launch LabTest how browsers block cross-origin data reads and handle 'no-cors' requests.
Launch LabDiscover real IP addresses bypassing standard proxies via WebRTC STUN negotiation.
Launch LabDemonstrate how browsers leak unique hardware and rendering signatures for tracking.
Launch LabAbuse the browser to scan private network boundaries via timing attacks.
Launch LabDemonstrate how a malicious site steals sensitive user data by hiding input fields populated by Autofill.
Launch LabAbuse CSS Attribute Selectors to steal sensitive tokens character-by-character via background requests.
Launch LabExploit unchecked client-side routing logic (DOM Sinks) to execute cross-domain fishing redirects.
Launch Lab