If you’ve searched for WebVerse, WebVerse Labs, or “what is WebVerse?”, this page is the clear answer. WebVerse Labs is a hands-on web and API security lab platform focused on realistic exploit chains, modern web application behavior, and practical offensive security learning. It is built for people who want
Lab: Tricky Tunnels (WebVerse) — FastAPI Debug Endpoint Info Disclosure Walkthrough Difficulty: Easy Theme: Unauthenticated debug endpoint leaking sensitive configuration (information disclosure / sensitive data exposure) Goal: Obtain the flag by enumerating exposed API routes and abusing an internal config leak Entry: http://localhost:8088 TL;DR Tricky Tunnels is an easy
If you’ve ever seen an API return someone else’s data just because you changed an ID, you’ve run into one of the most common real-world web security problems: broken authorization. API authorization failures usually don’t look like “a huge hack.” They look like a normal request
Lab: Quarter Shift Difficulty: Hard Theme: Multi-subdomain app + GraphQL + header-gated access tier + reset flow + SSRF into internal backoffice Goal: Reach the internal backoffice and download the Jackpot Incident Report (flag inside) Entry: http://quartershift.local TL;DR 1. Add quartershift.local to /etc/hosts and load the site. 2. Vhost/
Lab: Zipline Difficulty: Medium Theme: Export download BOLA/IDOR → debug artifact leak → internal API pivot → endpoint fuzzing Goal: Obtain the flag Entry: http://zipline.local TL;DR 1. Log into Zipline (admin:admin). 2. Identify the export download route: GET /api/v1/exports/{public_id}/download. 3. Exploit BOLA/IDOR
Lab: Role RipTide Difficulty: Easy Theme: AuthZ / IDOR-ish feel, but the real bug is mass assignment (role field) Goal: Obtain Flag Value Entry: http://localhost:8092 (WebVerse default) TL;DR 1. Create an account and log in. 2. Visit Settings and notice profile updates are sent via JSON. 3. Intercept