⚠ TEST ENVIRONMENT Web Security Testing Lab v1.0

MODULE INDEX

Select a module below to start testing.

CRITICAL

SQL INJECTION

Auth bypass, UNION extraction, blind and time-based techniques

HIGH

CROSS-SITE SCRIPTING

Reflected, Stored, and DOM-based variants

CRITICAL

COMMAND INJECTION

OS command execution via unsanitized user input

CRITICAL

FILE INCLUSION

Local and remote file inclusion via include()

HIGH

FILE UPLOAD

Unrestricted upload, no extension or MIME validation

HIGH

BROKEN AUTH

Weak credentials, session fixation, predictable tokens

HIGH

XML EXTERNAL ENTITY

XXE to read local files via XML parser

CRITICAL

DESERIALIZATION

Object injection via unsafe deserialization

HIGH

SSRF

Server-side request forgery to reach internal services

MEDIUM

PATH TRAVERSAL

Directory traversal to read files outside webroot

SQL INJECTION

OWASP A03

LOGIN — AUTH BYPASS

// output here

USER LOOKUP — UNION

// output here

SEARCH — BLIND

// output here

CROSS-SITE SCRIPTING

OWASP A03

REFLECTED

// output here

DOM-BASED

// output here

STORED — COMMENT BOARD

// output here

COMMAND INJECTION

OWASP A03

PING UTILITY

// output here

Terminal

// output here

DNS LOOKUP

// output here

FILE INCLUSION

OWASP A05

LOCAL FILE INCLUSION

// output here

REMOTE FILE INCLUSION

// output here

FILE UPLOAD

OWASP A04

UPLOAD — NO VALIDATION


// output here

UPLOAD — MIME BYPASS

Checks Content-Type header only, not actual file extension.


// output here

BROKEN AUTHENTICATION

OWASP A07

WEAK CREDENTIALS

// output here

SESSION FIXATION

// output here

PREDICTABLE RESET TOKEN

// output here

XML EXTERNAL ENTITY

OWASP A05

XML PARSER

// output here

INSECURE DESERIALIZATION

OWASP A08

DESERIALIZE OBJECT

// output here

GENERATE PAYLOAD

// output here

SERVER-SIDE REQUEST FORGERY

OWASP A10

URL FETCHER

// output here

WEBHOOK

// output here

PATH TRAVERSAL

OWASP A01

FILE READER

// output here

LOG VIEWER

// output here