▸ Hands-on penetration testing

Stop reading
about pentesting. Do it.

Learn web application penetration testing the only way that sticks — by exploiting real vulnerabilities yourself. Every lesson ends in a live target, right in your browser. No VM, no VPN, no setup. The login to the right is real — try to get in.

Start learning free →See how it works

✓ Runs in your browser✓ First flag in ~10 min✓ No credit card

admin.shoppr.test — inline labSQLi

Shoppr — staff sign-in

Log in as admin without the password.

Username

Password

admin' --' OR 1=1 --UNION SELECT …

SELECT username, role FROM users WHERE username = '' AND password = '…'

Awaiting input… the query above updates as you type.

Stuck? reveal a hint

Modules

667

Lessons

20+

Attack classes

Zero

Setup steps

// The loop

Learn it. Then break it.

Every lesson ends in a live target. Type the payload, watch it land, take the flag — the same loop a real penetration test runs on.

STEP 01

Learn the mechanism

Short, concrete theory — how the bug works, why the code is wrong, and the fix.

SELECT * FROM users
WHERE user = '
$input
'
AND pass = '$pw'
# the quote is the door →

STEP 02

Exploit it inline

A real app boots in your browser — routes, sessions, a live database. You type the payload; it runs.

payload › ' OR 1=1 --
→ query returns 4 rows
✓ authentication bypassed
no valid password needed

STEP 03

Capture the flag

Land the exploit and the flag drops from the response — validated instantly, then explained.

$ dumped users table
admin | 9f3c… |
HackrGG{un10n_s3l3ct_l34ks_1t_4ll}
✓ +250 XP · module cleared

SQLi login bypassIDOR account takeoverXSS stored & DOMJWT alg:none forgerySSRF to metadataCommand injectionPath traversalNoSQL operator injectionMass assignmentCSRFSQLi login bypassIDOR account takeoverXSS stored & DOMJWT alg:none forgerySSRF to metadataCommand injectionPath traversalNoSQL operator injectionMass assignmentCSRF

SSTI template injectionXXE external entitiesRecon & OSINTPrompt injection (LLM)Race conditionsDeserializationOAuth abuseCORS misconfigRequest smugglingSSTI template injectionXXE external entitiesRecon & OSINTPrompt injection (LLM)Race conditionsDeserializationOAuth abuseCORS misconfigRequest smuggling

// Guided journeys