Follow a realistic objective
Work through a staged attack path with payload hints, a live inspector, and fake application data.
SECURITYCIPHER · INTERACTIVE TRAINING
Free Interactive Cybersecurity Labs
Practice injection flaws in guided exploit labs, or review cloud architecture diagrams and flag misconfigurations. Everything runs in your browser with fake data only.
OWASP vulnerability labs
Practice injection, auth, and access-control flaws
LLM01 Prompt Injection
AI Prompt Injection
Exploit five fake RetailGPT assistants and learn why guardrails fail without proper boundaries.
- 5 levels
- Live inspector
- Client-only
A03 Injection
SQL Injection
Break MailTrail logins and lead search with quote tricks, UNION leaks, and boolean probes.
- 5 levels
- Live inspector
- Client-only
Architecture review
Spot misconfigurations in cloud diagrams
Each scenario is a fixed architecture map. Click components, flag what looks wrong, and submit for a scored debrief with remediation notes. More cloud and platform diagrams will land in this section over time.
How it works
Exploit the flaw, understand it, then verify the defense
See the root cause
Watch untrusted input cross a trust boundary so the vulnerable query or instruction flow is clear.
Apply and retest the fix
Compare the defensive pattern with the vulnerable implementation and confirm the original attack no longer works.
Safe by design: every exercise runs locally in your browser. The labs do not send attack payloads to a server, target a real application, or store your inputs. Progress is optional and stays in local browser storage.
Planned lessons
More labs on the roadmap
These lessons are being refined before public release. Their direct URLs remain unavailable until each lab meets the same exploit, explanation, defense, and retest standard.
Cross-Site Scripting
Reflect XSS payloads in a fake greeting app - watch HTML and the sandboxed preview change live.
A03 Injection · PlannedBroken Authentication
Abuse weak sessions, predictable tokens, and missing lockout in a fake employee portal.
A07 Auth Failures · PlannedIDOR
Swap invoice IDs in a REST viewer and see when the API forgets to check ownership.
A01 Broken Access Control · PlannedSSRF
Steer a thumbnail proxy toward internal hosts, metadata endpoints, and file URLs.
A10 SSRF · PlannedClickjacking
Layer invisible frames over a bank UI and learn why X-Frame-Options and CSP matter.
A04 Insecure Design · PlannedOpen Redirect
Hijack post-login redirects in VaultLane and craft phishing-ready Location headers.
A01 Broken Access Control · PlannedPath Traversal
Walk ../ sequences through a download portal and read files outside the web root.
A01 Broken Access Control · PlannedCommand Injection
Chain shell metacharacters through a ping utility and watch the command string mutate.
A03 Injection · PlannedXXE Injection
Upload malicious XML entities and exfiltrate secrets from a fake parser service.
A05 Security Misconfiguration · PlannedJWT Attacks
Forge JWT claims, flip algorithms, and bypass weak signature checks client-side.
A07 Auth Failures · PlannedCSRF
Simulate cross-site transfers with missing or weak anti-CSRF tokens on a wire form.
A01 Broken Access Control · PlannedSSTI
Inject template expressions into badge rendering and escalate to code execution paths.
A03 Injection · PlannedFile Upload
Bypass extension and MIME checks to plant a web shell in a fake upload pipeline.
A04 Insecure Design · PlannedOAuth Misconfiguration
Exploit redirect_uri and state mistakes in a simulated OAuth callback handler.
A07 Auth Failures · Planned
Questions
Security lab FAQ
Are these labs safe to use?
Yes. They are browser-only simulations with fake users, secrets, databases, and responses. No payload is sent to a vulnerable server or external target.
Which security labs are live?
SQL Injection, AI Prompt Injection, and the AWS 3-Tier Architecture Review lab are public. Other exploit lessons and future architecture scenarios on this page are roadmap items until they are ready.
Do I need an account?
No. All live labs are free without a login. Exploit-lab progress can be saved locally in your browser; architecture reviews are scored per attempt in the session.
What will I learn?
Each lesson connects exploitation to the underlying trust failure, a defensive coding pattern, and a retest that verifies the fix.