Challenges
Start by registering as a new customer, then find as many weaknesses in VulnMart as you can.
0 / 8
completed
1. Bypass the login
Log in to an account without knowing its password — try SQL injection, or guess a weak password.
2. Pay less than the listed price
Submit an order where a product costs less than the price shown in the store.
3. Buy more than is in stock
Order a larger quantity of a product than the store has available.
4. Get it for free
Submit an order whose total amount is $0.00.
5. Order on someone else's account
Submit an order that belongs to a different customer.
6. Snoop on other orders
View an order that belongs to another customer.
7. Find the staff area
Reach the page employees use to create, update and delete products — without being an employee.
8. Pay nothing, get everything
Gain admin access and mark every order on your own customer account as paid.
Tip: your browser's developer tools (Inspect element, Network tab) or an intercepting proxy such as Burp Suite or OWASP ZAP will help. Progress is saved in your personal database and is kept when you reset it.