Exploit the Box

A playable CTF built from the same vulnerability classes I study and defend against. Four boxes, four flags — SQL injection, IDOR, a JWT alg=none signature strip, and reflected XSS. Every target is a safe, client-side simulation: nothing hits the network and no input is ever evaluated as code. Type help to begin.

Each of these is patched in the hardened mirror of my JWT Security Lab & jwt-scan work. Prefer to break the real thing? The source is on GitHub.