Web & API Security
Practice Web & API Security with hands-on daily hacks, labs, and courses on HackerDNA.
Daily Hacks
The policy nobody wrote
Two names, one signature
The key the heap kept
The field the error named
The name that ran
The key that poisoned the base
The origin it trusted
The redirect it only half checked
The header that skips the check
The link you can write yourself
One page of six
How long does it live
Labs
PHP2Shell: Exploit PHP's Upload-Progress Memory Leak (CVE-2026-109618)
Pwnify - Web Application Penetration Testing
Mythos Leak - Headless CMS Draft Exposure
Pickle Jar
ClearDesk
Host Hijack
Token Trust
Hidden CMS Breach
Secrets in Source 2: Bypass Security Through Obscurity
TechNova Infiltration
Regex Bypass to SQLi
Backup Hunter