Launch your dedicated machine to begin hacking
- 1Create a free account, then click "Start Lab"You'll get your own private machine with an IP address
- 2Explore the targetOpen the IP in your browser and look for vulnerabilities
- 3Find and submit flagsFlags are secret text strings hidden in the system - paste them below to score
- ~1-2 min setup
- Private instance
- 30 min per session. Restart it for free, as often as you like.
What is web application penetration testing?
Web application penetration testing is the hands-on practice of attacking a real web app the way an adversary would: mapping its features, finding flaws in how it handles input and trust, and chaining those flaws into real impact. The best way to learn it is on a target that behaves like production software, not a stripped-down demo. Pwnify is built for exactly that.
How the Pwnify lab works
Pwnify is a working music-streaming application. You register an account, browse artists and albums, search the catalog, stream tracks in a real audio player, and build playlists you can share. Verified artists get a Studio where they upload their own music. None of it is faked, so every page is fair game for testing.
You begin as an anonymous visitor and finish, if you do it right, as root on the server. Two flags mark your progress: a user flag in a home directory once you land a shell, and a root flag in /root once you take over the host. The path runs through the web app first and then into the Linux machine behind it, so you practice both web application penetration testing and Linux privilege escalation in a single challenge.
What you will practice
This is a Hard lab with several non-obvious steps. You will reach a feature you are not meant to use, turn user input into command execution, recover and crack a stored credential, reuse it to log in, and abuse a misconfigured Linux capability to become root. Each link in the chain is a technique that shows up in real engagements. Work it from the HackerDNA Attack Terminal, take notes as you go, and open the learning tasks if you get stuck.
What You Will Learn
- Exploit a mass-assignment flaw to reach a hidden privileged feature
- Achieve remote code execution through OS command injection in media processing
- Crack a legacy MD5 password hash using rockyou with john or hashcat
- Pivot through password reuse to gain an SSH foothold and capture the user flag
- Escalate to root by abusing a Linux cap_setuid file capability
- Chain web and Linux techniques into a full web-to-root compromise
