Uphack Labs

Break. Fix. Learn.

From essential skills to advanced techniques, train like a security pro at your own pace.

36 labs 5 categories 0 completed

Start here Missing Access Control in Property Listings

New on Uphack

CamberStack NEW

Reflected XSS in Weekly Digest Signup

Advanced 25 min Free, no account

Gearbox NEW

IDOR via Base64 Encoded Return Credit Claim

Intermediate 30 min Free, no account

PayNest

Path Traversal Filter Bypass in an Image Proxy

Intermediate 25 min Members only

Tidegate Radio

XSS2Shell: Pre-authentication XSS in the WordPress Login Page

Advanced 40 min Free, no account

Cirra

Per-Method Authorization Gap in eSIM Plan Changes

Intermediate 25 min Members only

PayLedger

IDOR in Merchant Payouts via Client-Controlled App State

Advanced 35 min Members only

Why I built Uphack

Marius Horatau

Creator of Uphack

Security isn’t a list of payloads to memorise. The useful skill is learning how a system is meant to work, noticing the assumptions it makes, and knowing where to push to break those assumptions.

That’s how I build Uphack. Every lab starts as a believable product with one realistic security flaw buried in an ordinary feature.

I still build every lab myself. Opening four times a year gives me time to keep improving the experience between cohorts.

Thanks,

Autumn 2026 Open until 11 September

Registration is open.

Create your account and everything below is yours. This window closes on Friday 11 September.

1.

Get full access

All 36 labs and the lessons behind them.
2.

Track your progress

Solves are recorded, and finishing a path earns a certificate.
3.

Stay up to date

New labs land in your account as I publish them.

Create your account

Already a member? Sign in