OWASP TOP 10:2025 · HANDS-ON ARENA

Learn by
breaking safely.

Exploit real vulnerable behavior inside disposable, per-player environments. Track skills, points, and completion across every verified OWASP section.

Explore challenges Scoreboard
isolated-runner
$ arena status
✓ isolated exploit targets
✓ one lab per player
✓ rotating flags + expiry
200 verified labs ready_
VERIFIED LABS20020 matching this view
COMPLETED0/2000% of published arena
OWASP TRACKS10/10with published labs
POINTS0of 45400 available
YOUR ARENA PROGRESS

Sign in to measure progress

Solved labs, points, and OWASP track completion will be saved to your account.

0%
A01Broken Access Control0/20 solved · 0% A02Security Misconfiguration0/20 solved · 0% A03Software Supply Chain Failures0/20 solved · 0% A04Cryptographic Failures0/20 solved · 0% A05Injection0/20 solved · 0% A06Insecure Design0/20 solved · 0% A07Authentication Failures0/20 solved · 0% A08Software or Data Integrity Failures0/20 solved · 0% A09Security Logging and Alerting Failures0/20 solved · 0% A10Mishandling of Exceptional Conditions0/20 solved · 0%
CHALLENGE LIBRARY

Authentication Failures

Clear track ×
Reset
20 challengesPage 1 of 1
A07 · Authentication FailuresEasy
A07≈ 20 min

Unlimited Login

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
100 pts0 solvesAvailable
A07 · Authentication FailuresEasy
A07≈ 20 min

Account Oracle

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
100 pts0 solvesAvailable
A07 · Authentication FailuresEasy
A07≈ 25 min

Timeless Reset

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
100 pts0 solvesAvailable
A07 · Authentication FailuresEasy
A07≈ 25 min

Partial Logout

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
100 pts0 solvesAvailable
A07 · Authentication FailuresMedium
A07≈ 35 min

Fixed Session

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
200 pts0 solvesAvailable
A07 · Authentication FailuresMedium
A07≈ 35 min

Remember Forever

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
200 pts0 solvesAvailable
A07 · Authentication FailuresMedium
A07≈ 35 min

Skip the Second Step

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
200 pts0 solvesAvailable
A07 · Authentication FailuresMedium
A07≈ 30 min

Reusable Backup Code

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
200 pts0 solvesAvailable
A07 · Authentication FailuresMedium
A07≈ 35 min

Magic Link Replay

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
200 pts0 solvesAvailable
A07 · Authentication FailuresMedium
A07≈ 30 min

Token in the Referrer

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
200 pts0 solvesAvailable
A07 · Authentication FailuresMedium
A07≈ 30 min

Password Change Without Proof

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
200 pts0 solvesAvailable
A07 · Authentication FailuresMedium
A07≈ 30 min

Disabled but Active

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
200 pts0 solvesAvailable
A07 · Authentication FailuresMedium
A07≈ 35 min

Unsigned JWT

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
200 pts0 solvesAvailable
A07 · Authentication FailuresMedium
A07≈ 35 min

Trusted Device Cookie

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
200 pts0 solvesAvailable
A07 · Authentication FailuresMedium
A07≈ 35 min

Case Doppelganger

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
200 pts0 solvesAvailable
A07 · Authentication FailuresHard
A07≈ 40 min

OAuth Without State

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
350 pts0 solvesAvailable
A07 · Authentication FailuresHard
A07≈ 45 min

Link by Email

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
350 pts0 solvesAvailable
A07 · Authentication FailuresHard
A07≈ 40 min

Reset Host Poison

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
350 pts0 solvesAvailable
A07 · Authentication FailuresHard
A07≈ 45 min

Two Resets Win

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
350 pts0 solvesAvailable
A07 · Authentication FailuresHard
A07≈ 45 min

Refresh Replay

Investigate the application, map its behavior, and recover the rotating flag without a guided walkthrough.

YOU WILL PRACTICEAuthentication Failures
350 pts0 solvesAvailable