The full counter
A pick ’n’ mix of web app vulnerabilities
Fifteen flaws laid out as an attack path, easy to hard: break in from the front, get inside, abuse the access you earn, then dig into the server.
Follow the route to learn, or dive in wherever you like. Any exercise works in any order, and the grey-box accounts jump you straight to the logged-in ones. The 🔑 marks the pivot: Pick ’n’ Mix hands over the admin hash and the customer list, which opens up most of what follows.
Window shopping
No account neededWhat an anonymous visitor can break just by poking the inputs. Recon starts here, and so does the big unlock.
Pick 'n' Mix🔑
The search box builds its SQL by gluing strings together. Glue something else on.
Unlocks the whole customer table and the admin hash, which opens the staff areas and hands you accounts for the logged-in attacks.
Read the walkthrough →Sticky Label
Whatever you searched for comes back on the page, exactly as you typed it.
Read the walkthrough →Getting a key
AuthenticationTurn information into access: crack a login, reach the staff areas, break the session.
Helping yourself
Once you are inWhat a logged-in user can abuse. Broken access control and business logic, where being let in is not the same as being allowed everything.
Someone Else's Order
Your order is number 4. Nobody checked whether number 2 is yours.
Read the walkthrough →Half Price Humbugs
The browser tells the server what a bag of humbugs costs. Be generous to yourself.
Read the walkthrough →Gift Card Grinder
Six characters, no lockout, no delay. Bring a wordlist.
Read the walkthrough →Loyalty Loophole
Spend the same £5 of credit several times by asking all at once.
Read the walkthrough →Return to Sender
Change a customer's email with a link they never meant to click.
Read the walkthrough →Out the back
Deeper server-sideThe heavier server-side and stored attacks, often reachable only after you have earned some trust.
Bad Batch
Leave a review on the rhubarb & custard. Everyone who reads it runs your script.
Read the walkthrough →Recipe Card
Every sweet has an allergen sheet. The filename comes straight from you.
Read the walkthrough →Stock Check
No errors, no results echoed. Just in stock, out of stock, and a stopwatch.
Read the walkthrough →Wrapped Wrong
Your saved basket is merged back in without looking. Slip an extra key in.
Read the walkthrough →Delivery Note
Give it a tracking URL and it will fetch it. Any URL. From inside.
Read the walkthrough →Supplier Portal
Wholesalers upload stock lists as XML. The parser is trusting to a fault.
Read the walkthrough →Ask the Sweet Shop
The assistant recommends sweets. It also reads product descriptions you can edit.
Waiting on the AI assistantWant one that isn't here?
Open an issue with the flaw and a sketch of where it fits in a sweet shop. Realistic beats exotic. It should look like a mistake someone would actually make.
Suggest a challenge