Skip to content
PURPLEDUEL

Web Exploitation path

7 labs · Hidden dirs, cookies, access

Web Exploitation brings the basics into the world of websites and web applications, where a huge share of real attacks happen. You explore invented sites with HTTP requests from the terminal and discover folders someone hoped to hide, cookies the server trusts too much, factory credentials never changed, comments forgotten in the page source and error messages that say too much. The lessons follow the OWASP Top 10 categories, such as Broken Access Control and authentication failures, and each one explains the fix.

The labs, in order

  1. robots.txt and forgotten folders

    easy · 300 XP

    The Polo Nord ice cream shop has a simple website and a slightly naive owner: he tells search engines not to look in certain folders and thinks that keeps them safe. Explore the site, find out what he wants to hide and take home the flag.

    Requires: Mapping a host.

  2. The cookie that is trusted too much

    medium · 600 XP

    FitNova, the gym with the members app, decides who you are by looking at a cookie. You are an ordinary member: can you get into the place only staff can enter? Prove that a regular member can become an admin and retrieve the flag.

    Requires: robots.txt and forgotten folders.

  3. The manufacturer's manual

    medium · 600 XP

    The IP camera at the warehouse entrance has a web management panel. The manufacturer publishes manuals for all its models, and you have a folder full of them in ~/docs. Can you get in without guessing anything?

    Requires: robots.txt and forgotten folders and Searching text.

  4. Aurora — Web Breach

    medium · 1100 XP

    Aurora Corp left a legacy admin panel online. Prove that an exposed backup allows unauthorised access and retrieve the user flag.

    Requires: The cookie that is trusted too much and Who's on the network?.

  5. Clues in the page code

    medium · 550 XP

    Pizzeria Vesuvio has a website for booking tables, built in a hurry by an optimistic developer. A web page is a document the server hands to anyone: read it in full, including the parts the browser does not show you.

    Requires: The cookie that is trusted too much.

  6. Error messages that talk too much

    medium · 600 XP

    The Dolcemela pastry shop intranet is very polite: when you get the login wrong, it even tells you what you got wrong. Too polite? Find out who really has an account, then find your way into the restricted area.

    Requires: The manufacturer's manual.

  7. The complete portal

    hard · 1000 XP

    The supplier portal of Martello & Sons Hardware has more than one crack, but none is enough on its own: you have to chain them, each one gives you what you need for the next. Start from the target, get all the way to administration and grab the flag.

    Requires: Aurora — Web Breach, Clues in the page code and Error messages that talk too much.

Commands in this path

Along this path the simulated terminal has you use these commands: gobuster, curl, grep, nmap and cat. Each lab page explains what they are for.

Learn more with the guides

All guides

The other paths

The PurpleDuel labs