Ten self-contained labs, one per vulnerability class. No accounts needed — progress is saved locally in your browser. Every flag is verified with a local hash check, no answers sitting in plain text.
Start with A01 →Every lab in this range attacks the same fictional company — ShopFast Inc., a mid-size e-commerce and payments platform. As you clear labs, you're mapping out weaknesses across its actual systems: the storefront, the payments arm, the admin console, the CI/CD pipeline, and more. One target, ten different ways in — all under shopfast.io.
All ten OWASP Top 10 (2021) categories, A01–A10, one lab each — same company, different system each time.