SeaShaw Labs

Eighteen deliberately broken builds of the same photo-sharing site: six vulnerability classes, three levels each. Start at easy in any class - the medium level usually only makes sense once you have seen what the easy one does. Every lab carries its own objective page at /flag.php and a guided walkthrough in the panel on the right.

Cross-Site Scripting

Your input comes back as code instead of text.

EASY make the gallery run your JavaScript - a popup is enough register your own account :8111 MEDIUM get a comment past the filter and make it run - a popup is enough register your own account :8112 HARD run JavaScript without being able to open a single tag register your own account :8113

OS Command Injection

The server builds a shell command out of what you send.

EASY make the server run a command of your choosing and read a file you were never served sign in as admin / admin123 :8121 MEDIUM get past the character filter and read a file you were never served sign in as admin / admin123 :8122 HARD prove a command ran when the page never shows you a single byte of output sign in as admin / admin123 :8123

SQL Injection

Your input is pasted into the query, so you can write part of it.

EASY make the gallery search return a row the gallery does not own register your own account :8131 MEDIUM read a table one true-or-false question at a time register your own account :8132 HARD read a table through a filter, with nothing to go on but the clock sign in as diver_dan / dan123 :8133

Path Traversal & LFI

A filename from the request becomes a path the server reads.

EASY read a file from a directory the handout viewer was never meant to leave register your own account :8141 MEDIUM get past the traversal filter the last report earned register your own account :8142 HARD read a PHP file that the server would rather execute than show you register your own account :8143

Unrestricted File Upload

You pick the name, it lands in the web root, the server runs it.

EASY get your own code running on the web server through the avatar form register your own account :8151 MEDIUM get a file the deny list did not think of past the avatar form register your own account :8152 HARD satisfy a name sanitiser and a content check at the same time register your own account :8153

IDOR

It decides what you asked for, never whether you may have it.

EASY read the private half of somebody else's profile register your own account :8161 MEDIUM open a receipt that belongs to somebody else sign in as diver_dan / dan123 :8162 HARD open a private document addressed by an identifier you are not supposed to be able to guess sign in as diver_dan / dan123 :8163