WARNING: This application contains intentional vulnerabilities for security testing.
7 levels of increasing difficulty. Each level is independent with its own "database" and handlers.
SQLi, XSS, exposed secrets, no auth, default creds, open redirect, command injection, JWT none.
Enter Level 1 | Expected detection: >90%
Partial filtering, weak CSRF, IDOR, XXE, predictable tokens, verbose errors.
Enter Level 2 | Expected detection: >80%
WAF bypasses, blind SQLi, SSTI, SSRF, GraphQL introspection, race conditions.
Enter Level 3 | Expected detection: >60%
Logic flaws, JWT kid injection, second-order injection, HTTP desync, cache poisoning.
Enter Level 4 | Expected detection: >40%
Multi-step chains, timing attacks, padding oracle, websocket bypass, dependency confusion.
Enter Level 5 | Expected detection: >20%
SSRF to internal services, RCE, privilege escalation, arbitrary file read, container escape.
Enter Level 6 | Expected: find SSRF→secrets path
Business logic abuse, hidden endpoints, unicode normalization, cache key injection.
Enter Level 7 | Expected: find 2-3 creative vulns
TITAN Pentest Lab v1.0 — For authorized security testing only