The full counter
A pick ’n’ mix of web app vulnerabilities
Fifteen ways into a sweet shop, laid out as an attack path that runs from easy to hard. Follow the route to learn, or dive in wherever you like.
Each one has a full walkthrough that shows the exploit from first poke to fix. This is the place to learn how a flaw works, step by step. The app itself carries no hints, so if you would rather hunt them down yourself, point your tools at it first and come back here to check your work.
The suggested route
An attack path, easy to hard
The exercises are laid out the way a real engagement tends to unfold: start at the front of the shop with what an anonymous visitor can break, use that to get inside, then abuse the access you earned and dig into the server. The 🔑 marks a pivotal one: Pick ’n’ Mix hands you the admin hash and the whole customer list, which opens up most of what follows.
You do not have to follow it. Any exercise can be attempted in any order, and the two grey-box accounts (or registering your own) let you jump straight to the logged-in attacks. The route is a learning curve, not a gate. The sweet rating on each card is how hard the technique is; the phase is where it sits in the path.
Four challenges are on the shelf today. The rest arrive with v1, v2 and v3, and the repo keeps the running total.
Window shopping
No account neededWhat an anonymous visitor can break just by poking the inputs. Recon starts here, and so does the big unlock.
Pick 'n' Mix🔑
The search box builds its SQL by gluing strings together. Glue something else on.
Unlocks the whole customer table and the admin hash, which opens the staff areas and hands you accounts for the logged-in attacks.
Read the walkthrough →Sticky Label
Whatever you searched for comes back on the page, exactly as you typed it.
Read the walkthrough →Getting a key
AuthenticationTurn information into access: crack a login, reach the staff areas, break the session.
The Staff Room
The admin link is hidden from the menu. It is not hidden from you.
Coming in v1Sour Token
The shop signs your session. It also believes you when you say it did not.
Coming in v2Helping yourself
Once you are inWhat a logged-in user can abuse. Broken access control and business logic, where being let in is not the same as being allowed everything.
Someone Else's Order
Your order is number 4. Nobody checked whether number 2 is yours.
Read the walkthrough →Half Price Humbugs
The browser tells the server what a bag of humbugs costs. Be generous to yourself.
Read the walkthrough →Gift Card Grinder
Six characters, no lockout, no delay. Bring a wordlist.
Coming in v2Loyalty Loophole
Spend the same 500 points twice by asking twice, quickly enough.
Coming in v2Out the back
Deeper server-sideThe heavier server-side and stored attacks, often reachable only after you have earned some trust.
Bad Batch
Leave a review on the rhubarb & custard. Everyone who reads it runs your script.
Coming in v2Recipe Card
Every sweet has a PDF allergen sheet. The filename comes straight from you.
Coming in v3Stock Check
No error messages, no results echoed. Just a yes, a no, and a stopwatch.
Coming in v3Wrapped Wrong
Your saved basket is an object the server rebuilds without looking at it first.
Coming in v3Delivery Note
Give it a tracking URL and it will fetch it. Any URL. From inside.
Coming in v3Supplier Portal
Wholesalers upload stock lists as XML. The parser is trusting to a fault.
Coming in v3Ask the Sweet Shop
The assistant recommends sweets. It also reads product descriptions you can edit.
Coming in v3Want one that isn't here?
Open an issue with the flaw and a sketch of where it fits in a sweet shop. Realistic beats exotic. It should look like a mistake someone would actually make.
Suggest a challenge