Labs
Hands-on targets
Deliberately-vulnerable targets hosted here on purpose, so practising on them is legal. Each pairs a live thing to attack with a lesson that teaches the technique — second person, present tense: you do it. Prove it worked by capturing a flag.
Lazy Galleriesscrape-01
Harvest every image from a lazy-loaded, paginated gallery with an unknown page count — then find the flag hidden where the browser can't show it.
Cursor & Infinite Scrollscrape-02
The gallery has no page numbers — it feeds itself over a JSON cursor API, and the image URLs are nowhere in the page HTML. Find the endpoint and enumerate it.
The Defender's Viewlog-01
You just scraped the scrape-01 gallery. Here's the server's access log of it. Find the scraper from the defender's side — the attacker view and defender view of the same event.
On the bench
Rate Limits & Backoff
The gallery fights back: hammer it and it 429s. Pull the whole set the honest way — throttle, and respect Retry-After.
robots.txt & the Boundaries of Public
What robots.txt and sitemaps do — and don't — tell you, and what 'public' actually permits.