Practice labs / Harbourline Supply

They are all good and none of them is replaced by this. The difference is the cost of starting.

The honest summary: use these to learn the mechanics quickly and with no setup, and run a real vulnerable app locally when you want to practise driving sqlmap, Burp Intruder or a proxy against a network target. Those are different skills and both are worth having.

A browser can genuinely be the vulnerable thing for some classes and cannot possibly be for others. Rather than fake the difference, the labs state it.

Real exploitation — the exploit executes. SQL injection runs against a real parser and executor written for these labs, so operator precedence, MySQL's loose typing and its error messages all behave as they do on a target. XSS genuinely executes script. JWT forging uses real WebCrypto. A CORS lab is enforced by the browser itself.

Emulated runtime — the vulnerability is real code you defeat, and what sits behind it is simulated. A command injection lab has a real shell tokeniser, so ;, &&, | and $() parse exactly as they should, but the commands run against a virtual filesystem rather than an operating system. An SSRF lab has a genuinely bypassable URL parser in front of a virtual internal network. You defeat the same logic; nothing is actually compromised.

What is never true here is a lab that checks your input against a list of expected answers. If a payload works it is because it changed what the code does.

Because there is nothing shared to attack. A conventional vulnerable app is dangerous in public for three reasons: it is a server that can be compromised, it holds state that one visitor can poison for another, and it becomes a redirect and phishing platform on somebody's domain.

None of those apply. There is no server. There is no shared state — each visitor's target is created in their own tab. And the target is confined to an iframe sandboxed without allow-same-origin, so its origin is opaque: localStorage throws inside it, the parent page cannot reach its DOM, and a working XSS in a lab cannot touch this site.

That last point is the reason the sandbox is not optional. Every GitHub Pages site under an account shares one origin, so an unsandboxed XSS lab would be a genuine XSS on the toolkit itself — usable for phishing under its author's name. Containment first, then the vulnerability can be real.

Start with SQL injection, level 1. It is the cleanest introduction to the idea underneath most of this material: your input was supposed to be data, and it ended up being read as instructions. Everything from XSS to command injection is that same sentence with a different interpreter.

Then do level 3 of the same lab, by hand, without automating it. Extracting six characters through a one-bit oracle is tedious exactly once and it teaches you what the tools do. People who can only run sqlmap are the ones who stall the moment a target needs a payload shaped slightly differently.

Read the View source panel every time, including the fixed version. Being able to spot the pattern in code is what turns practice into a job.

They are being built one at a time and shipped when they are actually finished, rather than thirteen shallow ones at once. SQL injection is complete across all four levels, with the engine behind it covered by 79 tests and the levels themselves verified by a script that solves each one end to end, including a full blind extraction through the level 4 denylist.

If a particular class would help you sooner, say so on the feedback page and it moves up the order.