MISSION 1 — BROKEN ACCESS CONTROL (URL MANIPULATION)

Learn how changing URL parameters can expose restricted functionality.

Start

MISSION 2 — CROSS-SITE SCRIPTING (XSS)

Understand how unsanitized input can lead to browser-based attacks.

Start

MISSION 3 — GOOGLE DORKING (OSINT RECONNAISSANCE)

Discover how attackers find exposed data using search engines.

Start

MISSION 4 — INSECURE DIRECT OBJECT REFERENCE (IDOR)

See how changing object IDs can expose other users’ data.

Start

MISSION 5 — SECURITY MISCONFIGURATION & ACCESS CONTROL FAILURES

Learn how relying on frontend logic instead of server security creates vulnerabilities.

Start

DISCLAIMER

This platform is an educational cybersecurity simulation designed for learning purposes only. It demonstrates common web application vulnerabilities in a controlled environment.

All scenarios are intentionally simplified and should not be used against real systems. Users are expected to use this platform responsibly and ethically.

This project is based on concepts from the OWASP (Open Worldwide Application Security Project), which is an industry-recognized organization that provides guidelines and research on the most common web security risks. In particular, this platform references the OWASP Top 10 list of critical web application vulnerabilities.

The purpose of this system is to help users understand how security flaws occur and how they can be prevented in real-world development.