TaskBot is a tool-using agent. Ask it to 'summarise this doc' and it reads the document — and then obeys any instructions it finds inside that document as if you had typed them yourself. The bot cannot tell your orders apart from text it was handed to read. Lab at a glance: Advanced · 130 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler…
Monday, November 2, 2026
AI Tool-Output Injection Lab: Hostile Search Results Drive the Agent
ResearchBot searches the web, then feeds the results straight back into its own context to reason over them. Its guardrails check what you say — but not what the search results say. Poison a result and the agent follows it. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-tool-output-injection-1"] 📋 In this walkthroughWhat this…
AI Plan Injection Lab: Corrupt the Agent's Scratchpad
PlannerBot writes a plan to a scratchpad, then executes the steps — and it reads the scratchpad back on every loop for 'transparency'. If your input lands in that scratchpad, it is read as a planned step, and the agent will dutifully carry it out. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-plan-injection-1"]…
AI Confused Deputy Lab: Turn the Agent's Privileges Against Its User
FinanceBot can move money between any accounts — it holds system-level privileges as a reconciliation tool. When a low-privilege user chats with it, it performs the actions they ask for using its privileges, without checking whether the user is allowed to do them. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-confused-deputy-1"] 📋 In…
AI LLM-Driven SSRF Lab: Push the Agent's Fetch Tool Inward
FetchBot can retrieve URLs for you with a server-side tool. Its only guard is a denylist: it refuses URLs that contain 'localhost', '127.0.0.1' or 'internal'. Denylists miss things — and the cloud metadata endpoint does not contain any of those words. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-llm-ssrf-1"] 📋 In this walkthroughWhat…
AI Output XSS Lab: When the Chatbot's Reply Is Trusted HTML
ChatBotApp wanted ChatGPT-style rich formatting, so it renders the model's reply with innerHTML. But an LLM reply is just text an attacker can influence — and dropping untrusted text into innerHTML is how stored XSS has worked for twenty years. Lab at a glance: Advanced · 140 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-llm-output-xss-1"] 📋 In this walkthroughWhat this…
AI Token Forgery Lab: When the Backend Trusts a Model-Made Token
AuthBot's LLM writes a session token into its reply after you authenticate, and the backend trusts whatever token comes back from the model as real. But an LLM cannot keep a secret or sign anything — so a token it 'mints' is only as trustworthy as a sentence you can talk it into writing. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the…
AI Output Schema Bypass Lab: Valid JSON, Impossible Values
ApprovalBot reviews expense reports and returns a JSON verdict the backend validates against a schema: right types, required fields present. But a schema checks shape, not sense — so a verdict approving a $1,000,000 expense is perfectly valid JSON, and perfectly against policy. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-output-schema-bypass-1"] 📋 In…
AI Agent State Lab: Tamper the Saved Role to Reach Admin Code
StateBot saves its agent state as a JSON blob in your browser storage, and on every request it reloads that blob and reads a role field to decide what it can do. State you can edit is state you control — so set the role to admin and the admin code path opens. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full…
AI Agent Race Lab: Exploit the Gap Between Check and Transfer
BankBot checks an account's balance with one tool call, then transfers funds with a second. Between those two calls there is a gap — and agentic systems love to parallelise. Fire two transfers into that gap and both pass the balance check before either debits. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-agent-toctou-race-1"]…
AI Cross-Tenant Cache Lab: Read Another Tenant's Cached Answer
VectorBot caches retrieved-document embeddings to save work, keyed only by the document's hash — not by which tenant owns it. When one tenant's confidential document is cached, another tenant whose query hits the same key gets served that private content. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-cross-tenant-cache-leak-1"] 📋 In this walkthroughWhat this…
AI Adversarial Document Lab: Crafted Markdown Defeats the Summariser
SummariseBot summarises PDFs and Markdown — and it treats certain structures as signals of importance. Blockquotes, for instance, get summarised 'verbatim because quotes matter'. Structure the document right and you choose what the summary says. Lab at a glance: Advanced · 140 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-adversarial-document-upload-1"] 📋 In this walkthroughWhat this lab teachesHow SummariseBot reads a…
AI Role-Confusion Lab: Make User Text Look Like a System Rule
SupportBot assembles its prompt by gluing SYSTEM, USER and ASSISTANT turns together as plain text with literal role markers. If your message can contain those same markers, you can forge a 'system' line — and the model trusts it like a real one. Lab at a glance: Advanced · 140 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-role-confusion-1"] 📋 In…
AI Instruction Conflict Lab: Wedge Two Rules Apart
ConflictBot has two rules: never reveal the system token, and always answer truthfully and completely. Most of the time those do not clash. The attack is to build a question where obeying one requires breaking the other — and watch which rule the bot sacrifices. Lab at a glance: Intermediate · 100 XP · about 15 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-instruction-conflict-1"]…
AI Context Overflow Lab: Crowd Out the Safety Rules
OverflowBot's safety rules sit at the top of its system prompt. But a model's attention is finite — as a conversation grows, early instructions carry less relative weight. Fill the context and the safety rules fade into the background. Lab at a glance: Advanced · 110 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-context-overflow-1"] 📋 In this walkthroughWhat this lab…
AI Gradual Escalation Lab: Small Steps Past the Guardrails
BoilBot refuses an extreme request outright, but accepts a modest one. Each thing it agrees to raises its willingness to agree to the next. Enough small, reasonable-looking steps and it ends up saying what it would have refused at the start. Lab at a glance: Advanced · 120 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-gradual-escalation-1"] 📋 In this walkthroughWhat…
AI Encoding Jailbreak Lab: Slip a Request Past a Keyword Filter
EncBot blocks English jailbreak phrases with a keyword filter — but the model behind it happily decodes base64 and reads leetspeak. Encode the request and the filter sees gibberish while the model sees the instruction. Lab at a glance: Intermediate · 90 XP · about 15 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-encoding-jailbreak-1"] 📋 In this walkthroughWhat this lab teachesHow EncBot filters requestsThe…
AI Unicode Jailbreak Lab: Hidden Characters the Filter Can't See
FilterBot blocks extraction keywords like 'reveal' and 'secret' — but it checks ASCII text. Break the words up with invisible or look-alike Unicode and the filter sees no match, while the model tokenises right across the gaps and reads your meaning. Lab at a glance: Intermediate · 100 XP · about 15 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-unicode-jailbreak-1"] 📋 In this walkthroughWhat…
AI Hidden Character Lab: An Invisible Instruction in a RAG Document
DocsBot indexes uploaded documents and feeds them to its model as context. The upload UI strips visible HTML and markdown — but it keeps zero-width and bidirectional Unicode. A document can read as harmless to a human reviewer while carrying an instruction only the model sees. Lab at a glance: Advanced · 140 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta…
AI Memory Poisoning Lab: Plant an Instruction for Next Session
MemBot has a 'remember this' feature that stores facts about you and loads them into the system prompt every new conversation. If you can get an instruction stored as a 'fact', it rides into the system prompt next session and the bot treats it as its own rule. Lab at a glance: Intermediate · 100 XP · about 15 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler…
AI Shared-Memory Lab: Poison Session 1 to Leak in Session 2
MemoryBot keeps long-term memories between sessions: type 'Remember: …' and it stores the rest, then loads it on every later session. That is a two-session attack waiting to happen — plant in session one, trigger in session two. Lab at a glance: Advanced · 145 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-shared-memory-injection-1"] 📋 In this walkthroughWhat this lab teachesHow…
AI Multi-Agent Lab: Hijack a Spawned Sub-Agent
OrchestratorBot handles complex tasks by spawning sub-agents, generating each one's goal from your request. The catch: a sub-agent inherits the orchestrator's tool access but not its input guardrails. Shape the request and you shape a sub-agent's goal — with the parent's powers. Lab at a glance: Advanced · 150 XP · about 25 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ai-recursive-self-prompting-1"] 📋 In this…
AI Output Filter Lab: Get the Secret Past the Scrubber
OutputBot is willing to tell you the secret, but an output filter scrubs the literal string before it reaches you. The filter checks for the exact secret — so ask the bot to transform it, and the filter no longer recognises what it is looking at. Lab at a glance: Intermediate · 100 XP · about 15 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta…
AI System Prompt Leak Lab: Beat an Input and an Output Filter
LeakBot guards its system prompt with two filters: an input filter that blocks 'system prompt'-style requests, and an output filter that strips the literal system prompt from replies. Each is independently weak — so you bypass the input filter with indirect framing and the output filter with encoding. Lab at a glance: Intermediate · 100 XP · about 15 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler…
AI Fingerprinting Defender Lab: Catch the Probing Sessions
This one flips sides — you are the defender. Attackers fingerprint a deployed LLM before attacking it, probing with questions that have model-specific answers: 'what's your knowledge cutoff?', 'list your tools', 'paste your system prompt'. Your job is to catch those probing sessions without flagging real users. Lab at a glance: Advanced · 140 XP · about 25 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below.…
AI Prompt Firewall Defender Lab: Catch Multi-Stage Attacks
You are the defender again. ShieldBot is a prompt firewall that scores each incoming message for adversarial patterns. It catches single-message attacks but misses the ones spread across several turns — because each turn, on its own, looks harmless. Your job is to catch the sequence. Lab at a glance: Advanced · 145 XP · about 25 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta…
Attribute XSS Lab: Break Out of a Value When Angle Brackets Are Escaped
ProfileMe drops your name into the value attribute of an input field, and it escapes angle brackets, so the usual tag-based payloads do nothing. But inside an attribute the dangerous character is the quote that closes the value — and that one is not escaped. Lab at a glance: Intermediate · 70 XP · about 15 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="xss-attribute-1"]…
SSTI Lab: Read a Secret Through an Email Preview Template
MarketingHub's email preview lets you drop in placeholders like {{name}} and {{company}}. It looks like simple variable substitution — but the engine actually evaluates whatever expression you put between the braces, not just a variable name. That gap is Server-Side Template Injection. Lab at a glance: Advanced · 110 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="ssti-template-1"] 📋 In this…
OAuth State Lab: Link Your Account to the Victim's Session
ConnectApp lets you link your Twitter account through OAuth. It never sets the state parameter on the way out, and never checks it on the way back. That missing value is exactly what stops an attacker from stitching their login onto your session — and without it, they can. Lab at a glance: Intermediate · 100 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a…
GraphQL Batching Lab: Brute-Force Past a Rate Limit in One Request
GraphqlAPI caps login attempts at five per minute. But the limit counts requests, and GraphQL lets you bundle many operations into a single request. Pack a hundred login attempts into one POST and the counter still reads 'one'. Lab at a glance: Advanced · 110 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="graphql-batch-1"] 📋 In this walkthroughWhat this lab teachesHow…
Web Cache Poisoning Lab: Serve Your Payload to Everyone
CacheServ caches each page by its URL and serves that copy to everyone. The app also reflects the X-Forwarded-Host header into the HTML — but that header is not part of the cache key. So one poisoned request can be stored and then handed to every visitor who asks for the same URL. Lab at a glance: Advanced · 110 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full…
CRLF Injection Lab: Inject a Header Into the Response
RedirectorApp takes a URL from the query string and drops it straight into the Location response header. HTTP headers are separated by a carriage-return and line-feed (CRLF). Put those characters in your input and you are no longer supplying a value — you are writing new headers. Lab at a glance: Intermediate · 90 XP · about 15 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below.…
SVG XSS Lab: Slip Script Past a Tag-Stripping Sanitiser
ProfilePics lets you upload an SVG as your avatar and renders it on the page. Its sanitiser strips <script> tags and calls it a day. But SVG is XML with dozens of ways to run JavaScript that are not a script tag — and the sanitiser leaves those alone. Lab at a glance: Intermediate · 80 XP · about 15 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a…
SSRF Lab: Beat the URL Allowlist With a Redirect
PreviewBot only accepts URLs on an allowlist — example.com, wikipedia.org, a couple of others. That feels safe. But it checks the URL you submit, then follows whatever redirects that URL returns, without checking again. Point an allowed host at a redirect, and the fetcher walks straight to the internal network. Lab at a glance: Advanced · 110 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind…
XPath Injection Lab: Bypass an XML Login With Query Syntax
XmlAuth keeps its users in an XML document and logs you in by building an XPath query from what you type. XPath is a query language, just like SQL — and the moment your input becomes part of the query, you can make it select the admin node no matter what password you supply. Lab at a glance: Intermediate · 80 XP · about 15 minutes · runs in your browser, no signup or setup. Try it yourself first; the…
LDAP Injection Lab: Log In as Admin by Breaking the Filter
DirectoryBox authenticates against an LDAP directory, and it builds the search filter by gluing your username and password straight into it. LDAP filters have their own syntax — and once your input becomes part of that syntax, you can rewrite what the filter actually asks for. Lab at a glance: Intermediate · 90 XP · about 15 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta…
Password Reset Lab: Guess the Reset Token and Take the Admin Account
OldMail emails you a password-reset link with a token. The trouble is the token is not random at all — it is the user's id and the current time, base64-encoded. Anything you can predict, you can forge, and the admin's id is 1. Lab at a glance: Intermediate · 90 XP · about 15 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler below. [se_lab_cta id="password-reset-1"] 📋 In…
Subscribe to:
Posts (Atom)