Reflected XSS

Craft a basic reflected XSS payload for an unescaped search parameter.

SQL Injection Auth Bypass

Construct a SQL injection payload to bypass a login form.

IDOR Access Control

Identify the correct HTTP response code for unauthorized access to another user's resource.

JWT Algorithm None

Identify the target role value in a JWT algorithm-none privilege escalation attack.

CSRF Session Binding

Identify the CSRF weakness where any valid token is accepted regardless of session.

OS Command Injection

Craft a command injection payload to read /etc/passwd through a network diagnostic tool.

JWT RS256 to HS256 Confusion

Identify the JWT claim to modify in an RS256-to-HS256 algorithm confusion attack.

SSRF to Cloud Metadata

Identify the AWS IMDS IP address exploited via SSRF to steal IAM credentials.