#1Imminent
Wednesday, August 5, 2026 at 3:00 PM
Bypass de control de acceso vía un plano de API paralelo no documentado
VDP
Hard
HackerOne
~75 min
#BAC#API Abuse#Auth Bypass
By @gorkaComing soon · 9 labs
Upcoming labs on BBLABS
Here's what's coming. Subscribe to get access the moment they go live — no waiting, no late spoilers.
#2
Wednesday, August 12, 2026 at 3:00 PM
Stored XSS en el HTML exportado de transcripciones de un helpdesk
VDP
Medium
HackerOne
~45 min
#XSS#Information Disclosure
By @gorka#3
Wednesday, August 19, 2026 at 3:00 PM
Mutation XSS en el editor Trix (bypass sanitizer↔serializer)
VDP
Hard
HackerOne
~85 min
#XSS#BAC#Information Disclosure
By @gorka#4
Wednesday, August 26, 2026 at 3:00 PM
Escritura sin autorización en el endpoint de settings de un plugin de page-builder
VDP
Medium
HackerOne
~55 min
#BAC#API Abuse#Information Disclosure
By @gorka#5
Wednesday, September 2, 2026 at 3:00 PM
Enumeración de artefactos internos vía la API de listado de una media library
VDP
Medium
HackerOne
~50 min
#BAC#Information Disclosure#IDOR
By @gorka#6
Wednesday, September 9, 2026 at 3:00 PM
SQL injection error-based en la resolución de tenant de un portal de identidad
VDP
Medium
HackerOne
~50 min
#SQLi#Information Disclosure
By @gorka#7
Wednesday, September 16, 2026 at 3:00 PM
SSRF en un webhook de media que bypassa su guard DNS por TOCTOU (check-then-use sin pinning)
VDP
Hard
HackerOne
~90 min
#SSRF#Race Condition#API Abuse
By @gorka#8
Wednesday, September 23, 2026 at 3:00 PM
Blind SQL injection unauthenticated vía desincronización de un endpoint de peticiones agrupadas
VDP
Hard
HackerOne
~85 min
#SQLi#Information Disclosure#API Abuse
By @gorka#9
Wednesday, September 30, 2026 at 3:00 PM
IDOR horizontal en la API de contenidos de un editor de notebooks colaborativos
VDP
Medium
HackerOne
~55 min
#IDOR#BAC#API Abuse
By @gorkaInstant access
The moment they drop, they're yours
New labs every week based on real bug bounty reports. Cancel anytime.
Create your account and save your spot