SCWAFREEIntermediate

StackCracker Certified Web App Pentester

Find real vulnerabilities in a real web application under exam conditions.

Browser-based lab — no VPN needed. You will be notified once approved.
Duration
90 Minutes
Flags
5 flags
Pass mark
5/5 flags
Price
Free
Format
Practical CTF
Certificate
Instant

Who is this for?

→Penetration testers preparing for OSCP or eMAPT
→Bug bounty hunters wanting a structured credential
→Developers who want to understand how their apps get exploited
→Security engineers moving into offensive work

Skills tested

✓SQL injection — union-based extraction from a live database
✓IDOR — access control bypass via predictable object references
✓SSRF — internal network access via server-side requests
✓Stored XSS — cookie theft via persistent script injection
✓Authentication bypass — forged cookie to admin access

What the exam covers

▸Union-based SQL injection against a live SQLite database
▸IDOR via sequential order IDs with missing access control
▸SSRF to AWS EC2 metadata service (169.254.169.254)
▸Stored XSS with cookie exfiltration via /loot endpoint
▸Forged base64 remember-me cookie for admin authentication bypass

Why StackCracker?

◎
Real target
A live vulnerable web application, not a simulation.
▸
Instant certificate
Capture all 5 flags and your certificate is generated immediately.
⊕
Verifiable
Every certificate has a unique URL anyone can verify.
★
Browser only
No VPN needed. Access the lab directly from your browser.
COMPLETELY FREE

Ready to get certified?

Browser-based web app pentesting lab. No VPN needed. Request access and start exploiting.

Free. No VPN. You will get an email once approved.