Beginner-friendly WebVerse labs and walkthroughs focused on core web & API security skills: recon, auth basics, IDOR/BOLA, mass assignment, and common logic bugs. Start here if you’re new to WebVerse or want quick wins. Play labs at webverselabs.com.
Easy
Lab: Tricky Tunnels (WebVerse) — FastAPI Debug Endpoint Info Disclosure Walkthrough Difficulty: Easy Theme: Unauthenticated debug endpoint leaking sensitive configuration (information disclosure / sensitive data exposure) Goal: Obtain the flag by enumerating exposed API routes and abusing an internal config leak Entry: http://localhost:8088 TL;DR Tricky Tunnels is an easy
Easy
Lab: Role RipTide Difficulty: Easy Theme: AuthZ / IDOR-ish feel, but the real bug is mass assignment (role field) Goal: Obtain Flag Value Entry: http://localhost:8092 (WebVerse default) TL;DR 1. Create an account and log in. 2. Visit Settings and notice profile updates are sent via JSON. 3. Intercept