Tier 4 // Burp-Style Workbench · lab · brief · sw-ctf.js

CyberWorld :: Intercept

Hack the impossible. Defend the future.

Operator Playbook

This workbench is a browser-local breach arena. Run small wins fast, then chain primitives into simulated operator control.

Recommended chain: get a forged identity, escalate authz, then pivot through headers and race logic.

Path AIdentity breachF22 -> F24 via forged JWT.

Path BControl pivotF27/F28/F29 for trust and timing abuse.

Path CDeep chainF31/F32/F33 capstone findings.

Analyst mode: endpoint descriptions and one-click exploit demos are hidden. Use the request builder and opt-in hints.

Tactical feedSyncing exploit relay...

Click an entry to load it into the request builder. Items tagged decoy are intentional false flags.

Headers (one per line, "Name: Value") Body (POST/PUT only)

-- --

(send a request to see the response)

Responses come from this browser's training service worker. Role and grant fields are puzzle artifacts, not FLLC account permissions.

Some auto-confirm when the right exploit response is observed; others want an answer in the input box.

A deeper, separate chain: key confusion, prototype pollution, and cache-before-auth.

0/13 confirmed