Web · Beginner
Legacy Access
A legacy login flow behaves strangely. Can you get through without valid credentials?
Alter Domus Cyber Challenge 2026
Interactive Security Labs
These are intentionally vulnerable, synthetic training applications. Manual testing is enough. Do not run automated vulnerability scanners, brute-force tools, or high-volume fuzzing against this site.
Scope: test only the challenge pages and APIs on this site. Nothing here is connected to corporate systems or real data.
Web · Easy
Document Vault
The application is meant to expose only approved documents. See whether the download boundary holds.
Web · Medium
Restricted Records
You have access to one case record. Does knowing another record identifier grant access to it?
Web · Medium
Profile Upgrade
The profile editor looks harmless. Inspect what the browser sends and what the server accepts.