live case files · vapt teaching lab
Two open case files. In each one, you'll operate a live, simulated web app exactly like a real user or attacker would — then walk forward and backward through every stage of what's happening behind the screen: in the request, on the server, and in the database.
// This entire lab runs client-side in your browser. There is no real server, database, or network request behind any of it — every "attack" is a scripted simulation built for teaching. Nothing here should be pointed at a system you don't own.
A login form trusts whatever you type into it. Learn how a single quote and two dashes can turn a password check into an open door — and how to extract an entire user table without logging in at all.
A comment box repeats back exactly what you type — including code. Watch a payload travel from the input field, into storage, and into another visitor's browser, where it quietly executes.
A live login form is wired to a simulated database below. Type into it like a real user — then step through what the backend actually does with what you typed.
A live comment box posts to a simulated discussion thread below. Type a comment like a real user — then step through what happens when it's stored and shown to someone else.