Purple Edge
Get started

Web Application Attacker

intermediate9 labsSubscription

End-to-end exploitation of OWASP-class web vulnerabilities against live deliberately-vulnerable apps: recon, injection, auth, access control, upload, traversal, command injection, and API/JWT attacks.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    intermediate Hands-on lab Subscription

    Web Recon & Content Discovery

    Map a web app's attack surface: brute-force directories and virtual hosts with gobuster/ffuf, mine robots.txt, and loot an exposed .git directory.

    35 min3 tasksWeb Exploitation
  2. 2
    intermediate Hands-on lab Subscription

    SQL Injection

    Exploit SQL injection from the ground up: error-based extraction, UNION-based data dumping, and blind boolean/time techniques, then automate the whole thing with sqlmap.

    45 min3 tasksWeb Exploitation
  3. 3
    intermediate Hands-on lab Subscription

    Cross-Site Scripting (XSS)

    Inject JavaScript into web apps via reflected, stored, and DOM-based XSS, then weaponize it to steal session cookies and hijack accounts.

    40 min3 tasksWeb Exploitation
  4. 4
    intermediate Hands-on lab Subscription

    Broken Authentication & Session Attacks

    Attack login and session handling: credential brute-forcing with Hydra, authentication logic bypasses, and exploiting weak or predictable session tokens.

    40 min2 tasksWeb Exploitation
  5. 5
    intermediate Hands-on lab Subscription

    IDOR & Broken Access Control

    Manipulate object identifiers and roles to read other users' data and reach admin-only functions: horizontal and vertical privilege escalation via IDOR and missing authorization.

    40 min2 tasksWeb Exploitation
  6. 6
    intermediate Hands-on lab Subscription

    File Upload to RCE

    Bypass file-upload filters (extension, content-type, magic bytes), plant a webshell, and turn an innocent upload form into full remote code execution.

    45 min3 tasksWeb Exploitation
  7. 7
    intermediate Hands-on lab Subscription

    LFI/RFI & Path Traversal

    Read arbitrary files via path traversal and Local File Inclusion, pull in remote code with RFI, and escalate LFI to remote code execution through log poisoning and PHP wrappers.

    45 min3 tasksWeb Exploitation
  8. 8
    intermediate Hands-on lab Subscription

    Command Injection

    Inject OS commands through unsanitized input: chaining operators, blind detection, and out-of-band (OOB) exfiltration when there is no visible output.

    40 min3 tasksWeb Exploitation
  9. 9
    advanced Hands-on lab Subscription

    API & JWT Attacks

    Attack REST APIs and JSON Web Tokens: endpoint enumeration, mass assignment, and JWT forgery via the alg:none trick and weak-HMAC cracking with jwt_tool and hashcat.

    50 min3 tasksWeb Exploitation

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-06-06