Coming soon · 7 labs

Upcoming labs on BBLABS

Here's what's coming. Subscribe to get access the moment they go live — no waiting, no late spoilers.

#1Imminent
Tuesday, November 17, 2026 at 2:00 PM

Lectura de conversaciones privadas en un clon de WhatsApp Web: IDOR de chat, IDOR de reenvío, JWT sin firmar, Web Cache Deception y XSS almacenado

This hack was reported with no reward
Hard
HackerOne
~90 min
#IDOR#Auth Bypass#XSS#Information Disclosure
By @gorka
#2
Tuesday, November 24, 2026 at 2:00 PM

Geolocalización de la dirección real de una creadora en una red social de fotos (EXIF, geotag automático, over-share de ubicación, IP-leak y XSS)

This hack was reported with no reward
Hard
HackerOne
~45 min
#Information Disclosure#XSS#BAC#API Abuse
By @gorka
#3
Tuesday, December 1, 2026 at 2:00 PM

Escalada de privilegios en un clon de Discord: IDOR, Web Cache Deception, mass assignment, XSS y JWT sin firmar hasta control total

This hack was reported with no reward
Hard
HackerOne
~100 min
#IDOR#BAC#Auth Bypass#XSS#Privesc#Information Disclosure
By @gorka
#4
Tuesday, December 8, 2026 at 2:00 PM

SQLi en el login abre una cadena de IDOR que filtra la facturación de toda una tienda de tecnología

This hack was reported with no reward
Hard
HackerOne
~45 min
#SQLi#IDOR#BAC#Information Disclosure#Auth Bypass
By @gorka
#5
Tuesday, December 15, 2026 at 2:00 PM

Una cadena de 5 fallos de lógica de negocio permite vaciar carteras ajenas y retirar 1.000 € desde un monedero que empieza con 1 €

This hack was reported with no reward
Hard
HackerOne
~55 min
#Race Condition#IDOR#Business Logic#BAC#API Abuse
By @gorka
#6
Tuesday, December 22, 2026 at 2:00 PM

13 fallos de lógica de negocio en un programa de referidos: dinero infinito y robo de sesión de staff

This hack was reported with no reward
Hard
HackerOne
~60 min
#Business Logic#IDOR#Race Condition#API Abuse#XSS#BAC
By @gorka
#7
Tuesday, December 29, 2026 at 2:00 PM

Del portal público al enclave de claves: SQLi, LFI, IDOR, SSRF, SSTI y RCE en el sitio de una agencia espacial

This hack was reported with no reward
Hard
HackerOne
~90 min
#SQLi#Path Traversal#IDOR#SSRF#RCE
By @gorka

Instant access

The moment they drop, they're yours

New labs every week based on real hacks. Cancel anytime.

Create your account and save your spot
4,619

hunters training

70

labs from real hacks

2,185

completions

$14,790

paid out for these bugs

36 flags captured this month·Real hacks from HackerOne · YesWeHack · Bugcrowd·No commitment·Free Academy
Free · no account

The checklist I run on every new target

47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.

Unsubscribe in one click, from any email.

BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.

No card · free Academy · cancel anytime

The community

This isn't a platform with users.It's people breaking the same things you are.

Inside people ask, share what they found and solve together what would block anyone on their own. It's free to join: no account, no plan, no email required.

Join the BBLABS community on Discord
Join the Discord

Free and open. You don't need a BBLABS account to join.