OWASP TOP 10:2025 · HANDS-ON ARENA

Learn by
breaking safely.

Exploit real vulnerable behavior inside disposable, per-player environments. Track skills, points, and completion across every verified OWASP section.

Explore challenges Scoreboard
isolated-runner
$ arena status
✓ isolated exploit targets
✓ one lab per player
✓ rotating flags + expiry
200 verified labs ready_
VERIFIED LABS20020 matching this view
COMPLETED0/2000% of published arena
OWASP TRACKS10/10with published labs
POINTS0of 45400 available
YOUR ARENA PROGRESS

Sign in to measure progress

Solved labs, points, and OWASP track completion will be saved to your account.

0%
A01Broken Access Control0/20 solved · 0% A02Security Misconfiguration0/20 solved · 0% A03Software Supply Chain Failures0/20 solved · 0% A04Cryptographic Failures0/20 solved · 0% A05Injection0/20 solved · 0% A06Insecure Design0/20 solved · 0% A07Authentication Failures0/20 solved · 0% A08Software or Data Integrity Failures0/20 solved · 0% A09Security Logging and Alerting Failures0/20 solved · 0% A10Mishandling of Exceptional Conditions0/20 solved · 0%
CHALLENGE LIBRARY

Injection

Clear track ×
Reset
20 challengesPage 1 of 1
A05 · InjectionEasy
A05≈ 20 min

Login Query

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
100 pts0 solvesAvailable
WebEasy
A05≈ 20 min

Search Reflection

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
100 pts0 solvesAvailable
A05 · InjectionEasy
A05≈ 25 min

Spreadsheet Export

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
100 pts0 solvesAvailable
A05 · InjectionEasy
A05≈ 25 min

Forged Audit Line

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
100 pts0 solvesAvailable
A05 · InjectionMedium
A05≈ 35 min

Order by Blindness

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
200 pts0 solvesAvailable
A05 · InjectionMedium
A05≈ 30 min

Document Login

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
200 pts0 solvesAvailable
A05 · InjectionMedium
A05≈ 35 min

Directory Filter

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
200 pts0 solvesAvailable
A05 · InjectionMedium
A05≈ 35 min

Diagnostic Ping

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
200 pts0 solvesAvailable
A05 · InjectionMedium
A05≈ 35 min

Support Timeline

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
200 pts0 solvesAvailable
A05 · InjectionMedium
A05≈ 30 min

Fragment Preview

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
200 pts0 solvesAvailable
A05 · InjectionMedium
A05≈ 35 min

Header Split

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
200 pts0 solvesAvailable
A05 · InjectionMedium
A05≈ 30 min

Mail Subject

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
200 pts0 solvesAvailable
A05 · InjectionMedium
A05≈ 35 min

XML Selector

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
200 pts0 solvesAvailable
A05 · InjectionHard
A05≈ 45 min

Stored Query Seed

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
350 pts0 solvesAvailable
A05 · InjectionHard
A05≈ 45 min

Option Smuggling

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
350 pts0 solvesAvailable
A05 · InjectionHard
A05≈ 45 min

Receipt Template

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
350 pts0 solvesAvailable
A05 · InjectionHard
A05≈ 45 min

Markdown Link

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
350 pts0 solvesAvailable
A05 · InjectionHard
A05≈ 45 min

External Invoice

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
350 pts0 solvesAvailable
A05 · InjectionHard
A05≈ 45 min

Prototype Settings

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
350 pts0 solvesAvailable
A05 · InjectionHard
A05≈ 50 min

Expression Search

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEInjection
350 pts0 solvesAvailable