LAB DIRECTORY
Choose a security domain 11 focused topics
Application and API vulnerabilities 9 categories Exploit Instagram Using SQLi Practice SQL injection in a fictional Instagram-style app's Explore search and login form.
APPRENTICE 1 PRACTITIONER 0
Sign in to track your progress.
View lab details FEATURED SQL INJECTION LAB APPRENTICE SIGN IN TO TRACK
Exploit Instagram Using SQLi Practice SQL injection in a fictional Instagram-style training app. Test the Explore search and login form, then learn how parameterized queries prevent input from changing query logic. No real Instagram account or service is involved.
Search the Instagram-style Explore page for a normal profile and observe matching training posts. Test SQL injection in Explore and compare the returned results. Test the fictional Instagram login form with a login-bypass input. Explain how unsafe query construction lets input alter query logic. Describe how parameterized queries separate user input from SQL syntax. Show full walkthrough and solution Open Explore in the fictional Instagram-style training app and try a normal profile search. Test the SQL injection input in Explore and observe the matching training results. Open Login, test the SQL injection login-bypass input, and observe the simulated response. The vulnerability occurs when untrusted input is concatenated into SQL and changes query logic. Use parameterized queries and least-privilege database access to prevent SQL injection.
WhatsApp Authentication Bypass Explore authentication bypass in a fictional WhatsApp-style OTP simulator. Use fictional test data only.
APPRENTICE 1 PRACTITIONER 0
Sign in to track your progress.
View lab details FEATURED AUTHENTICATION BYPASS LAB APPRENTICE SIGN IN TO TRACK
WhatsApp Authentication Bypass Explore a fictional WhatsApp-style phone verification flow and learn how weak OTP handling can undermine authentication. Use only the simulator's test data; never enter a real phone number or account credentials.
Inspect the phone-number and one-time-code steps in the fictional login flow. Test the simulator's training OTP and observe how the verification step responds. Explain why a predictable or reusable OTP weakens account authentication. Describe secure OTP expiry, single-use enforcement, rate limiting, and delivery controls. Download the provided candidate codes for this fictional simulator only. Do not use this list against real accounts or services.
Show full walkthrough and solution Open the WhatsApp-style training simulator from DH Labs. Use only clearly fictional test data in the phone-number form; do not enter a real number. Continue to the OTP verification step and test the simulator's assigned training code. A predictable code that is accepted without expiry, single-use, or attempt controls represents weak verification. Use cryptographically random short-lived codes, bind each code to one challenge, invalidate after use, and rate-limit attempts.
Access Control: Private Profile IDOR Log in to the fictional TikTok-style training site, then change a profile ID in the address bar to observe insecure direct object references (IDOR) and broken object-level authorization.
APPRENTICE 2 PRACTITIONER 0
Sign in to track your progress.
View lab details FEATURED ACCESS CONTROL LAB APPRENTICE SIGN IN TO TRACK
Access Private Profile Through IDOR Log in to the fictional TikTok-style training site, then change a profile ID in the address bar to observe insecure direct object references (IDOR) and broken object-level authorization.
Log in with the prefilled fictional training account. Use the single address bar to change the profile ID from 1042 to 1043 and compare the profiles. Identify why changing an object identifier must not grant access to another user's private data. Retrieve the training flag shown on the exposed profile and submit it through DH Labs. Explain how server-side object ownership checks prevent IDOR and broken object-level authorization. Show full walkthrough and solution Log in using the prefilled fictional training credentials. The address bar opens your profile at tiktok.com/profile/1042. Change only the numeric ID to tiktok.com/profile/1043 and select Go. The displayed profile and its private data change even though the signed-in user did not change. Copy the training flag shown on the exposed profile and submit it in the DH Labs proof form. The accepted training flag is DH{you_changed_the_id_and_found_someone_elses_private_profile_data}. This local simulation demonstrates the vulnerability. Prevent it in real applications by checking, on every server request, that the authenticated user is authorized to access the requested object. Do not rely on hidden UI controls or hard-to-guess identifiers.
Browse a fictional video platform, open a thumbnail in a new tab, then use that tab's address bar to reach a sandboxed /etc/passwd training file through path traversal.
APPRENTICE 1 PRACTITIONER 0
Sign in to track your progress.
View lab details FEATURED PATH TRAVERSAL LAB APPRENTICE SIGN IN TO TRACK
Path Traversal: Read the Training File Browse a fictional video platform, open a thumbnail in a new tab, then use that tab's address bar to reach a sandboxed /etc/passwd training file through path traversal.
Open a video thumbnail in the training browser's new tab. Change the image path to include ../../../etc/passwd and inspect the simulated file response. Identify why joining an untrusted path to a storage directory is unsafe without a containment check. Submit the training flag shown in the sandboxed file. Explain how canonical-path validation and an allowlisted file identifier prevent traversal. Show full walkthrough and solution Open the Path Traversal lab from DH Labs. Select any sample video thumbnail, then choose Open image in new tab. In the new tab's address bar, enter video.test/media/../../../etc/passwd and select Go. The sandboxed response shows a fictional Linux account list, including the lab's linus account. No host files are read. Submit the flag shown in the DH Labs file viewer. Prevent traversal by mapping opaque identifiers to allowed files or resolving the final canonical path and verifying it remains inside the allowed root before opening it.
Unsafe construction of operating-system commands.
APPRENTICE 1 PRACTITIONER 0
Sign in to track your progress.
Explore topic SIGN IN TO TRACK Command Injection Unsafe construction of operating-system commands.
Business Logic Vulnerabilities Use Burp Suite to inspect the supplied Amazon-style demo checkout and test whether its client-supplied price is trusted. The target is a dedicated training app, not Amazon.
APPRENTICE 1 PRACTITIONER 0
Sign in to track your progress.
Explore topic FEATURED BUSINESS LOGIC LAB APPRENTICE SIGN IN TO TRACK
Bypass Client-Side Price Validation Use Burp Suite to inspect the supplied Amazon-style demo checkout and test whether its client-supplied price is trusted. The target is a dedicated training app, not Amazon.
Route the designated training browser through Burp Suite and limit scope to v0-dh-amazon.vercel.app. Inspect the demo hoodie checkout request and identify any price or total controlled by the browser. Test whether changing the client-supplied price can bypass the demo wallet's balance check. Explain why the server must calculate totals from trusted product data and enforce payment invariants. Submit the supplied training flag through DH Labs to save your result. Show full walkthrough and solution Start Burp Suite and use its built-in browser, or configure a dedicated browser to use the Burp proxy at 127.0.0.1:8080. Install Burp's CA certificate in that browser to inspect HTTPS. Set Burp Target scope to v0-dh-amazon.vercel.app only, then open the supplied training app from this page. In Proxy > HTTP history, inspect the designated demo's Add to Cart or Buy Now traffic and identify the checkout request that carries the product amount. Use only this training target: send the checkout request to Repeater, change the client-supplied price to fit the demo wallet, and resend it. Compare the response with the original request. The client-side price validation is bypassed when the checkout accepts a browser-modified price instead of recalculating the amount from trusted server-side product data. Submit DH{client_side_price_validation_bypassed} in DH Labs. Do not test Amazon or any other site.
Information Disclosure — Debug Information Trigger a controlled error in an isolated fictional training portal, inspect the simulated response, and identify the debug details that should remain in protected server-side logs.
APPRENTICE 1 PRACTITIONER 0
Sign in to track your progress.
View lab details SIGN IN TO TRACK Trigger a controlled error in an isolated fictional training portal, inspect the simulated response, and identify the debug details that should remain in protected server-side logs.
File Upload Vulnerabilities Upload validation, storage, and safe file delivery.
APPRENTICE 1 PRACTITIONER 0
Sign in to track your progress.
Explore topic SIGN IN TO TRACK File Upload Vulnerabilities Upload validation, storage, and safe file delivery.
Server-Side Request Forgery Server-side URL fetching and destination controls.
APPRENTICE 1 PRACTITIONER 0
Sign in to track your progress.
Explore topic SIGN IN TO TRACK Server-Side Request Forgery Server-side URL fetching and destination controls.
Browser vulnerabilities 2 categories Exploit Netflix Using XSS Practice reflected XSS in a fictional Netflix-inspired catalogue.
APPRENTICE 1 PRACTITIONER 0
Sign in to track your progress.
View lab details FEATURED XSS LAB APPRENTICE SIGN IN TO TRACK
Exploit Netflix Using XSS Explore a fictional Netflix-inspired streaming archive and its catalogue search. Use the search flow to observe how untrusted input is handled in this reflected-XSS exercise.
Open the catalogue search and submit a harmless marker so you can observe the normal search flow. Compare the submitted value with the results page and identify where the value is reflected. Test a harmless XSS proof in this training app and observe the browser dialog. Explain how context-aware output encoding prevents reflected cross-site scripting. Show full walkthrough and solution Open the catalogue search in the fictional training app. Submit a harmless marker and observe how the app displays the search value. Use the lab's approved harmless XSS proof in the search flow and observe the browser dialog. The issue is reflected XSS: attacker-controlled input is interpreted as HTML or script rather than rendered as text. Prevent the issue by applying context-aware output encoding and avoiding unsafe HTML insertion.
Cross-Site Request Forgery Unwanted actions triggered through a signed-in browser.
APPRENTICE 1 PRACTITIONER 0
Sign in to track your progress.
Explore topic SIGN IN TO TRACK Cross-Site Request Forgery Unwanted actions triggered through a signed-in browser.
