Welcome back, Najeeb
Skill map
Click a category to openContinue training
SQL Injection — Login Bypass
Recommended for you
See allReflected XSS Basics
Find and exploit a reflected XSS flaw.
Classic Ciphers
Break Caesar, Vigenère & substitution.
Phishing Triage
Analyse a suspicious email safely.
Categories
Browse labs and challenges by category. Empty tracks are coming soon.
Labs
Download the files, follow the walkthrough, and submit your answers. Each lab has its own icon; filter by category below.
Web Security Fundamentals
Read-along primer on the core web attack surface — no answer to submit.
SQL Injection — Login Bypass
Bypass a login form using unsanitised input; 4 guided tasks.
Reflected XSS Basics
Find and exploit a reflected cross-site scripting flaw.
Broken Access Control
Reach another user's data by tampering with an ID.
Classic Ciphers
Break Caesar, Vigenère, and substitution ciphers.
Hashes & Cracking
Identify hash types and recover weak passwords.
Weak RSA
Recover a key from poorly chosen RSA parameters.
Phishing Email Triage
Analyse headers and payloads from a suspicious .eml.
PCAP: Find the Exfil
Trace data exfiltration in a captured session.
Linux Privilege Escalation
Escalate from a low-priv user to root on a Linux box.
Windows Log Hunt
Spot the attacker's foothold in Windows event logs.
Buffer Overflow 101
Smash the stack and redirect execution flow.
Crackme #1
Reverse a small binary to recover the correct key.
Trace the Handle
Pivot across public sources to identify an account.
Hidden in Plain Sight
Extract a secret concealed inside an image file.
Static Triage
Profile a sample with static analysis — no detonation.
No matching labs
Try a different category or clear your search.
Challenges
Standalone CTF challenges — no walkthrough. Grab the files, find the flag, submit it for points.
Season 1 · Capture the Flag
Cookie Monster
Algorithm: None
XOR Me
Faulty Signature
Ret2Win
Keygen Me
Carve It Out
Ghost Handle
Deep Pixel
Sanity Check
Leaderboard
Season 1 · ranked by points earned across all labs and challenges.
| Rank | Student | Solved | Points |
|---|---|---|---|
| 01 | MKm.karimova | 34 | 3,410 |
| 02 | ARa.rahimov | 31 | 2,980 |
| 03 | JTj.tashkent | 28 | 2,640 |
| 04 | SDs.davron | 25 | 2,300 |
| 05 | NBn.bek | 22 | 2,010 |
| 06 | LTl.turgun | 20 | 1,740 |
| 07 | NInajeebibrahimmYOU | 18 | 1,240 |
| 08 | RSr.sultan | 16 | 1,120 |
| Rank | Student | Solved | Points |
|---|---|---|---|
| 01 | SDs.davron | 25 | 2,300 |
| 02 | LTl.turgun | 20 | 1,740 |
| 03 | NInajeebibrahimmYOU | 18 | 1,240 |
| 04 | RSr.sultan | 16 | 1,120 |
| 05 | AKa.komil | 13 | 910 |
Profile
Your progress, achievements and account.
Najeeb Ibrahim
Skills breakdown
Achievements
Account & access
Recent activity
Preferences
Skillchecks
Per-track skill assessments — pass one to prove you've mastered a track. Submissions are verified and released by an instructor.
Web Exploitation
Cryptography
Forensics
Operating Systems
Binary Exploitation
Reverse Engineering
Admin
Create students, release solves, and schedule content releases.
Create a user
Students can't self-register — accounts are provisioned here (closed registration).
Roster
| Student | Cohort | Role | Status | Actions |
|---|
Pending solve releases
When a student solves a lab or skillcheck it waits here until you release it.
| Student | Item | Track | Submitted | |
|---|---|---|---|---|
ARa.rahimov | Ret2Win | Pwn | 12m | |
MKm.karimova | Web Exploitation (skillcheck) | Web | 1h | |
LTl.turgun | SQL Injection — Login Bypass | Web | 3h |
All caught up
No submissions waiting for release.
Content release schedule
Schedule when labs, skillchecks and CTFs become visible to students.
| Content | Type | Track | Release date | |
|---|---|---|---|---|
| Web Track — Final Challenge | CTF | Web | Aug 12 | |
| Cryptography & Reversing path | Path | Crypto | Aug 15 | |
| Malware Analysis pack | Labs | Malware | Aug 20 | |
| Web Exploitation Skillcheck | Skillcheck | Web | Aug 6 | Published |
Settings
Manage your account, appearance and notifications.
Account & access
Appearance
Notifications
Security
Danger zone
SQL Injection — Login Bypass
Walkthrough
1. What is SQL injection?
Web apps often build a database query by pasting user input straight into the query string. If a login form builds its query like this, the input becomes part of the command:
SELECT * FROM users WHERE user = '$username' AND pass = '$password';
2. Breaking out of the string
Enter ' OR '1'='1 as the password. The quote closes the string, and the always-true OR makes the whole condition true — so the database returns a row and the app logs you in.
3. Try it
Download the sample app, run it locally, and sign in with the payload above. Then answer the tasks on the right.
Tasks
How was this lab?
Your feedback helps our authors tune difficulty.
Web Security Fundamentals
How the web gets attacked
Almost every web attack comes down to the same root cause: data supplied by a user is treated as trusted code or commands. Before you exploit anything, it helps to see the whole attack surface at once.
The request/response you can bend
A browser sends an HTTP request — a method, a URL, headers, and often a body. The server trusts far too much of it. Every part of that request is attacker-controllable, so every part is a potential injection point.
POST /login HTTP/1.1 Host: shop.example Content-Type: application/x-www-form-urlencoded user=admin&pass=' OR '1'='1
Where trust breaks down
Input concatenated into a query becomes SQL injection; reflected into a page becomes XSS; used to build a file path becomes path traversal; used to pick a record becomes broken access control. Same cause, different sink.
What to do next
You don't need to submit anything for this lab — just make sure the model above makes sense. When you're ready, mark it complete and start the SQL Injection lab in this path.
Finished reading?
Marking complete records this lab on your profile and advances your training path.
Training paths
Follow an ordered set of labs, from fundamentals to challenge. Your progress is tracked automatically as you solve.
Web Exploitation Fundamentals
From the HTTP request up to injection, XSS and access control.
Forensics & Network Analysis
Triage emails, carve files, and follow the packets to the exfil.
Cryptography & Reversing
Break classic ciphers, crack hashes, and reverse a small binary.
Blue Team Starter
Log hunting, detection and incident triage.