A place to learn. A system to explore.
Working browser exercises and established cybersecurity labs for practical learning.
EXERCISES & EXTERNAL RESOURCESA practical starting point: our working browser exercises alongside established cybersecurity labs. External environments are operated by their respective providers; availability and account requirements vary.
Object-level authorization
Change a record ID, observe unauthorized access, then verify ownership enforcement.
Web Security Academy
Interactive labs covering SQL injection, XSS, authentication and access control.
WebGoat
Guided lessons in a deliberately vulnerable application. Follow the project’s local setup instructions.
Bandit
Practice shell navigation, permissions and command-line investigation through progressive levels.
CyLab Security Academy
The successor to picoCTF’s learning platform, with challenges in forensics, cryptography and web exploitation.
Export-control experiment
Compare a vulnerable tool gateway, enforced authorization and missing evidence.
External resources are linked for learning; no affiliation or integration is claimed. CyberMindSpace hosted lab infrastructure remains in development.
Object authorization:
verify the boundary.
Who owns the record?
Read your record, then change the ID from 1042 to 1043. Enable the authorization check and repeat the same request.
The response and finding will appear here.