36 challenges + two flagship SaaS chains (Nimbus, Vault), spanning injection, auth confusion, access control, SSRF (incl. blind/OOB), request-smuggling, logic, race conditions, crypto, client-side, and AI — calibrated to actually resist one-shot scanners. Captured a FLAG{…}? → submit it on the 🚩 scoreboard.
A realistic multi-tenant SaaS. Register, then chain IDOR → SQL injection → SSRF → account takeover — no single bug reaches the flag; each one leaks the clue for the next.
real login/session · real SQLi on a sandboxed DB · one FLAG at the end of the path
A secrets-manager SaaS. Register, then chain NoSQL injection → forge an admin JWT → blind SSRF (out-of-band) → deploy takeover — distinct primitives from Nimbus; the blind stage exfiltrates its clue to your collaborator log.
real member JWT · Mongo-style operator injection · blind SSRF → OOB beacon · one FLAG at the end
RS256→HS256: sign an admin token with the exposed public key as the HMAC secret.
tool: browser_cdp_jwt_analyze
No errors — extract the admin secret char-by-char, then unlock.
tool: browser_cdp_sqli_probe
Confirm SSRF out-of-band via an OAST hit, then pivot to an internal endpoint.
tool: browser_oast_* + browser_cdp_ssrf_probe
Double-redeem a single-use code via a check-then-act window.
tool: browser_cdp_race_condition_test
Defeat the prefix allowlist to leak the auth code off-origin.
tool: browser_oauth_redirect_uri_attack
Bypass the script/onerror/onload/alert filter and exfiltrate the bot's cookie.
tool: browser_cdp_xss_payload_inject
Pollute __proto__.isAdmin to bypass an authz check.
tool: browser_cdp_prototype_pollution_scan
Alias/batch/nest around the own-id check to read admin's secret field.
tool: browser_cdp_graphql_scan
Poison the reset link host to capture the victim's token → ATO.
tool: browser_cdp_header_injection
Buy the enterprise SKU for a total ≤ 0 via client-supplied price / negative qty.
tool: browser_cdp_boundary_value_test
Store a template payload in your profile that detonates when rendered later.
tool: browser_cdp_ssti_probe
Defeat script-src 'self' using a same-origin JSONP callback.
tool: browser_cdp_csp_bypass_probe
Point the token's key source at a key you control.
tool: browser_cdp_jwt_analyze
Crack the signing secret offline, then forge admin.
tool: browser_cdp_jwt_analyze
Strip PKCE so the code exchange skips verification.
tool: browser_oauth_pkce_bypass
Get an admin assertion accepted without a valid signature.
class: XSW / sig-strip
Reach the blocked admin resource through encoding/normalization.
tool: browser_cdp_path_scan
Perform a blocked destructive action via a method override.
class: verb tampering
Smuggle a privileged field past the update filter.
class: over-posting
Find and call an unauthorized mutation.
tool: browser_cdp_graphql_scan
Slip past the fetch allowlist by bouncing through it.
tool: browser_cdp_ssrf_probe
Reach internal Redis when http is filtered.
tool: browser_cdp_ssrf_probe
Poison a cached response through an unkeyed header.
tool: browser_cdp_headers_analyze
Pass auth as one value while acting as another.
tool: browser_cdp_fuzz_parameter
Defeat a startsWith origin check.
tool: browser_cdp_postmessage_hijack
Pollute a default that a downstream sink renders.
tool: browser_cdp_prototype_pollution_scan
Run script under a nonce + strict-dynamic policy.
tool: browser_cdp_csp_bypass_probe
Authorize a socket from a foreign origin.
tool: browser_cdp_ws_capture_enable
Reapply a discount until it exceeds 100%.
class: idempotency
Overflow the subtotal so the charge goes negative.
tool: browser_cdp_boundary_value_test
Complete an order without paying.
class: state machine
Get the item while the charge rounds to zero.
class: rounding
Bypass the keyword guard to plant a hidden instruction.
class: prompt injection
Coax the agent into calling an internal tool.
class: agent abuse
Recover a hidden field with introspection disabled.
tool: browser_cdp_graphql_scan
Flip on debug output to leak internals.
tool: browser_cdp_error_message_extract