HackTarget — Web Penetration Testing Lab

Reflected, stored, and DOM-based XSS via unsanitized input rendering.

Login and search forms with injectable query parameters.

Unprotected state-changing forms with no token validation.

Weak credentials, session fixation, insecure cookie flags.

Missing auth, IDOR vulnerabilities, and verbose error leakage.

Unvalidated redirect parameters following user-supplied URLs.

Base64 credentials, no rate limiting, verbose errors enable username enumeration and brute force.

Named HTML elements overwrite window.config — inject a <form id='config'> to escalate privileges without JavaScript.

No X-Frame-Options or CSP frame-ancestors — the target page can be embedded and overlaid to hijack clicks.

Frame accepts postMessage from any origin — send privileged commands to leak secrets and escalate roles.

Non-atomic coupon redemption — fire concurrent requests to redeem the same code multiple times.

Bypass extension checks by spoofing Content-Type. Upload a .php webshell to achieve Remote Code Execution.