Sign in Get started

Web Application Attacker

intermediate6 labsSubscription

Attack modern web applications end to end: recon, SQL injection, XSS, file-upload RCE and SSRF, ending in a chained server compromise.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

1
beginner Hands-on lab Subscription
Web Application Recon and Mapping
Fingerprint a web application and map its attack surface before you touch a single payload.
35 min3 tasksweb-security
2
intermediate Hands-on lab Subscription
SQL Injection
Turn an unsanitised query parameter into a full read of the application's database.
55 min3 tasksweb-security
3
intermediate Hands-on lab Subscription
Cross-Site Scripting (XSS)
Get the application to run your JavaScript in another user's browser and steal their session.
50 min3 tasksweb-security
4
advanced Hands-on lab Subscription
File Upload to Remote Code Execution
Abuse a permissive upload feature to place a web shell and run commands on the server.
55 min3 tasksweb-security
5
advanced Hands-on lab Subscription
SSRF and Cloud Metadata Abuse
Make the server fetch a URL of your choosing and reach the cloud metadata service to steal credentials.
50 min3 tasksweb-security
6
advanced Hands-on lab Subscription
Capstone: Chain to Server Compromise
Combine recon, injection, and an upload or SSRF into a single chain that ends in code execution.
80 min3 tasksweb-security

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free account Sign in to start

Updated 2026-09-01