Ten self-contained labs, one per vulnerability class. Every flag is verified server-side — no shortcuts, no answers in the page source.
Create an account →Every lab in this range attacks the same fictional company — ShopFast Inc., a mid-size e-commerce and payments platform. As you clear labs, you're mapping out weaknesses across its actual systems: the storefront, the payments arm, the admin console, the CI/CD pipeline, and more. One target, ten different ways in — all under shopfast.io.
All ten OWASP Top 10 (2021) categories, A01–A10, one lab each — same company, different system each time.
Ranked by points earned across cleared labs.