🔓 VulnLab Platform

Laboratório de vulnerabilidades PHP deliberadamente inseguro para estudo de pentesting e segurança ofensiva.

Challenges

Serviços

Categorias OWASP

Flags CTF

SQLi, session hijacking, brute force, weak hashing.

SQL Injection, XSS Stored/Reflected, Command Injection, XXE.

SQLi Search XSS Reflected

Unrestricted upload, path traversal / LFI, directory listing.

Upload Files Path Traversal

alg:none bypass, weak secret, token forgery.

JWT Lab

PHP unserialize() inseguro, object injection, POP chains.

Deserialize Lab

IDOR, missing auth, privilege escalation, CSRF.

Access Control Lab Admin Panel

Serviço	URL	Vulnerabilidades
Web App	/	SQLi, XSS, IDOR, File Upload, Path Traversal
REST API	/api/	SQLi, Mass Assignment, IDOR, CSV Injection, No Auth
Admin Panel	/admin-panel/	Auth Bypass, Cmd Injection, LFI, CSRF, phpinfo
Aux Service	/service/	XXE, SSRF, Type Juggling, Log Poisoning