Prove the exploit.

A sandboxed application and an attacker console, entirely in your browser. Read a handler, find the defect, and prove it with a request that succeeds against the vulnerable build and fails against the fixed one. Then ship the fix.

const rows = ctx.db.query(
  `SELECT * FROM orders WHERE id = ${req.params.id}`
);

> GET /orders/1'%20OR%20'1'='1
< 200  — 5 rows, and two of them are not yours

Start hunting Read first

Defect classes: 26 of 26
Exercises: 41
Applications: 4
Lessons: 21

Nothing here reaches a real host

Every target is a fixture running in this tab. There is no network, there is no “try it against your own URL”, and there is not going to be one. The page ships a policy that makes that true rather than merely stated, and everything you do stays in this browser.