13 hands-on labs built around "Dummy Insta" — a realistic, deliberately vulnerable social app. SQL injection to full RCE, one flip of a switch at a time.
Start hacking → See the labsEvery attack has a script, a Burp walkthrough, and a one-line fix you can flip on and re-run.
Log in as admin without knowing the password by breaking out of the SQL query.
Skip the one-time-code step entirely by sending an empty OTP field.
Automate guessing the 4-digit code until the right one is found.
Recover a weak password from a small wordlist with no lockout in place.
Flood a slow endpoint on a single-worker server until it stalls for everyone.
Read a secret one-time-code straight out of a JSON API response.
Beat a 'max 3 attempts' limiter by firing many requests at once (TOCTOU).
Read other users' data through forced browsing and an IDOR in the account API.
Crack a weak Flask signing key and forge an admin session cookie.
Run your own JavaScript in the page via reflected and stored XSS.
Escalate a template bug from '7*7=49' to full remote code execution.
Chain an OS command onto a 'ping' feature to run arbitrary shell commands.
Climb out of an allowed folder with '../' to read the server's own source and /etc/passwd.
Enter your lab code, open your dashboard, launch a lab against the live Dummy Insta target, then flip
SECURE_MODE and watch the same attack fail.