OWASP TOP 10:2025 · HANDS-ON ARENA

Learn by
breaking safely.

Exploit real vulnerable behavior inside disposable, per-player environments. Track skills, points, and completion across every verified OWASP section.

Explore challenges Scoreboard
isolated-runner
$ arena status
✓ isolated exploit targets
✓ one lab per player
✓ rotating flags + expiry
200 verified labs ready_
VERIFIED LABS20048 matching this view
COMPLETED0/2000% of published arena
OWASP TRACKS10/10with published labs
POINTS0of 45400 available
YOUR ARENA PROGRESS

Sign in to measure progress

Solved labs, points, and OWASP track completion will be saved to your account.

0%
A01Broken Access Control0/20 solved · 0% A02Security Misconfiguration0/20 solved · 0% A03Software Supply Chain Failures0/20 solved · 0% A04Cryptographic Failures0/20 solved · 0% A05Injection0/20 solved · 0% A06Insecure Design0/20 solved · 0% A07Authentication Failures0/20 solved · 0% A08Software or Data Integrity Failures0/20 solved · 0% A09Security Logging and Alerting Failures0/20 solved · 0% A10Mishandling of Exceptional Conditions0/20 solved · 0%
CHALLENGE LIBRARY

All published labs

Reset
200 challengesPage 1 of 5
A01 · Broken Access ControlEasy
A01≈ 20 min

Invoice Switchboard

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEBroken Access Control
100 pts1 solvesAvailable
A01 · Broken Access ControlEasy
A01≈ 20 min

Friendly Slug

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEBroken Access Control
100 pts0 solvesAvailable
A02 · Security MisconfigurationEasy
A02≈ 15 min

Debug Receipt

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESecurity Misconfiguration
100 pts0 solvesAvailable
A02 · Security MisconfigurationEasy
A02≈ 20 min

Factory Password

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESecurity Misconfiguration
100 pts0 solvesAvailable
A02 · Security MisconfigurationEasy
A02≈ 20 min

Indexed Backups

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESecurity Misconfiguration
100 pts0 solvesAvailable
A02 · Security MisconfigurationEasy
A02≈ 20 min

Cookie on the Wire

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESecurity Misconfiguration
100 pts0 solvesAvailable
A02 · Security MisconfigurationEasy
A02≈ 25 min

Mapped Secrets

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESecurity Misconfiguration
100 pts0 solvesAvailable
A02 · Security MisconfigurationEasy
A02≈ 25 min

Storage Listing

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESecurity Misconfiguration
100 pts0 solvesAvailable
A02 · Security MisconfigurationEasy
A02≈ 20 min

Helpful Exception

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESecurity Misconfiguration
100 pts0 solvesAvailable
A02 · Security MisconfigurationEasy
A02≈ 20 min

Environment Viewer

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESecurity Misconfiguration
100 pts0 solvesAvailable
A02 · Security MisconfigurationEasy
A02≈ 20 min

Forgotten Sample App

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESecurity Misconfiguration
100 pts0 solvesAvailable
A03 · Software Supply Chain FailuresEasy
A03≈ 25 min

One Letter Off

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESoftware Supply Chain Failures
100 pts0 solvesAvailable
A03 · Software Supply Chain FailuresEasy
A03≈ 25 min

Latest Is Mutable

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESoftware Supply Chain Failures
100 pts0 solvesAvailable
A03 · Software Supply Chain FailuresEasy
A03≈ 25 min

Unlocked Production

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESoftware Supply Chain Failures
100 pts0 solvesAvailable
A03 · Software Supply Chain FailuresEasy
A03≈ 30 min

Ancient Base Layer

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESoftware Supply Chain Failures
100 pts0 solvesAvailable
A04 · Cryptographic FailuresEasy
A04≈ 25 min

Patterned Profiles

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICECryptographic Failures
100 pts0 solvesAvailable
A04 · Cryptographic FailuresEasy
A04≈ 30 min

Fast Password Vault

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICECryptographic Failures
100 pts0 solvesAvailable
A04 · Cryptographic FailuresEasy
A04≈ 30 min

Key in the App

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICECryptographic Failures
100 pts0 solvesAvailable
A04 · Cryptographic FailuresEasy
A04≈ 25 min

Coupon Randomness

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICECryptographic Failures
100 pts0 solvesAvailable
A04 · Cryptographic FailuresEasy
A04≈ 30 min

Saltless Archive

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICECryptographic Failures
100 pts0 solvesAvailable
A04 · Cryptographic FailuresEasy
A04≈ 25 min

QR Secret Exposure

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICECryptographic Failures
100 pts0 solvesAvailable
A05 · InjectionEasy
A05≈ 20 min

Login Query

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
100 pts0 solvesAvailable
WebEasy
A05≈ 20 min

Search Reflection

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
100 pts0 solvesAvailable
A05 · InjectionEasy
A05≈ 25 min

Spreadsheet Export

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
100 pts0 solvesAvailable
A05 · InjectionEasy
A05≈ 25 min

Forged Audit Line

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
100 pts0 solvesAvailable
A06 · Insecure DesignEasy
A06≈ 25 min

Coupon Replay

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInsecure Design
100 pts0 solvesAvailable
A06 · Insecure DesignEasy
A06≈ 20 min

Negative Cart

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInsecure Design
100 pts0 solvesAvailable
A06 · Insecure DesignEasy
A06≈ 25 min

Client Sets Price

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInsecure Design
100 pts0 solvesAvailable
A06 · Insecure DesignEasy
A06≈ 25 min

Refer Yourself

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInsecure Design
100 pts0 solvesAvailable
A06 · Insecure DesignEasy
A06≈ 25 min

Permanent Share

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInsecure Design
100 pts0 solvesAvailable
A06 · Insecure DesignEasy
A06≈ 30 min

Recovery by One Fact

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInsecure Design
100 pts0 solvesAvailable
A07 · Authentication FailuresEasy
A07≈ 20 min

Unlimited Login

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
100 pts0 solvesAvailable
A07 · Authentication FailuresEasy
A07≈ 20 min

Account Oracle

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
100 pts0 solvesAvailable
A07 · Authentication FailuresEasy
A07≈ 25 min

Timeless Reset

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
100 pts0 solvesAvailable
A07 · Authentication FailuresEasy
A07≈ 25 min

Partial Logout

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
100 pts0 solvesAvailable
A08 · Software or Data Integrity FailureEasy
A08≈ 25 min

Price State

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESoftware or Data Integrity Failures
100 pts0 solvesAvailable
A08 · Software or Data Integrity FailureEasy
A08≈ 20 min

Hidden Status

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESoftware or Data Integrity Failures
100 pts0 solvesAvailable
A08 · Software or Data Integrity FailureEasy
A08≈ 30 min

Checksum from Same Server

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESoftware or Data Integrity Failures
100 pts0 solvesAvailable
A09 · Security Logging and Alerting FailEasy
A09≈ 20 min

Silent Login Failure

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESecurity Logging and Alerting Failures
100 pts0 solvesAvailable
A09 · Security Logging and Alerting FailEasy
A09≈ 25 min

Secret in Plain Log

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESecurity Logging and Alerting Failures
100 pts0 solvesAvailable
A09 · Security Logging and Alerting FailEasy
A09≈ 25 min

Actor Unknown

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESecurity Logging and Alerting Failures
100 pts0 solvesAvailable
A09 · Security Logging and Alerting FailEasy
A09≈ 25 min

PII Everywhere

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESecurity Logging and Alerting Failures
100 pts0 solvesAvailable
A09 · Security Logging and Alerting FailEasy
A09≈ 25 min

MFA Failure Missing

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICESecurity Logging and Alerting Failures
100 pts0 solvesAvailable
A10 · Mishandling of Exceptional ConditiEasy
A10≈ 20 min

Stack Trace Receipt

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEMishandling of Exceptional Conditions
100 pts0 solvesAvailable
A10 · Mishandling of Exceptional ConditiEasy
A10≈ 25 min

Pagination Infinity

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEMishandling of Exceptional Conditions
100 pts0 solvesAvailable
A01 · Broken Access ControlMedium
A01≈ 35 min

Workspace Boundary

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEBroken Access Control
200 pts0 solvesAvailable
A01 · Broken Access ControlMedium
A01≈ 30 min

Owner by Request

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEBroken Access Control
200 pts0 solvesAvailable
A01 · Broken Access ControlMedium
A01≈ 30 min

Private Export

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEBroken Access Control
200 pts0 solvesAvailable