Introducing the mystery lab challenge

Summary: PortSwigger added a mystery lab challenge to its Web Security Academy that generates a random lab for users to find and exploit, with the objective hidden by default. The challenge has three settings: objective fully hidden, objective displayed, and full de-anonymization of the lab, intended to add an element of in-application recon that named labs like "SSRF with filter bypass via open redirection vulnerability" give away.
Bottom line: Academy labs name the vulnerability class and the bypass in the title, while a pentester tasked with uncovering all vulnerabilities or only high-impact unauthenticated issues gets no such clues - the gap this feature is built to close.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026