30 real-world vulnerabilities across PHP, Python & Node.js. Three difficulty levels. One lab to master them all.
Breachforge gives you a complete cybersecurity training environment with real exploits, progressive difficulty, and multi-stack coverage.
No install, no Docker, no config. Open the site in your browser and every challenge is live across all three stacks.
> Loading Breachforge ● PHP stack online ● Python stack online ● Node.js stack online ● MySQL + MongoDB online ✓ Lab ready — pick a challenge and start exploiting
Every vulnerability implemented across three real production stacks.
Each vulnerability has three levels. Low teaches the concept. Medium adds flawed defenses. High requires creative bypass techniques.
$ curl "http://target/01-sqli/low?user=' UNION SELECT 1,name,value,4 FROM flags-- -" HTTP/1.1 200 OK BF{a1b2c3d4e5f6} $ curl "http://target/01-sqli/high?user=' /*!UNION*/ /*!SELECT*/ 1,name,value,4 FROM flags-- -" HTTP/1.1 200 OK BF{7e8f9a0b1c2d}
Beyond single-vuln drills, Attack Labs stitch three to six bugs into full kill chains. Land a foothold, pivot internally, escalate privileges, and exfiltrate — one flag at the final step.
> Lab 04 · Microservice Hub step 1 NoSQL injection → session as bob step 2 SSRF to metadata → leak admin creds step 3 zip-slip upload → plant role override step 4 IDOR invoice read → pull premium record ✓ BF{chain_flag_here}
See who's captured the most flags. Log in and sync your progress to claim your rank.
| # | Hacker | Challenges | Labs | Total | Last Capture |
|---|---|---|---|---|---|
| Loading… | |||||
No captures yet. Be the first to claim a spot!
$ curl "http://target/07-ssrf/medium?url=http://169.254.169.254/latest/meta-data/" HTTP/1.1 200 OK Content-Type: text/html ami-id hostname instance-id BF{3d4e5f6a7b8c} $ echo "Flag captured. Moving to high difficulty..."
"Breachforge has been a game changer for our security team. The progressive difficulty model taught junior engineers more in a week than months of theory."
30 challenges covering the OWASP Top 10 and beyond. Filter by stack, pick your difficulty, and start exploiting.
30 vulnerabilities. 3 stacks. 90 exploits. Pick a challenge and capture your first flag.