Coming soon · 7 labs
Upcoming labs on BBLABS
Here's what's coming. Subscribe to get access the moment they go live — no waiting, no late spoilers.
Geolocalización de la dirección real de una creadora en una red social de fotos (EXIF, geotag automático, over-share de ubicación, IP-leak y XSS)
Escalada de privilegios en un clon de Discord: IDOR, Web Cache Deception, mass assignment, XSS y JWT sin firmar hasta control total
SQLi en el login abre una cadena de IDOR que filtra la facturación de toda una tienda de tecnología
Una cadena de 5 fallos de lógica de negocio permite vaciar carteras ajenas y retirar 1.000 € desde un monedero que empieza con 1 €
13 fallos de lógica de negocio en un programa de referidos: dinero infinito y robo de sesión de staff
Del portal público al enclave de claves: SQLi, LFI, IDOR, SSRF, SSTI y RCE en el sitio de una agencia espacial
Instant access
The moment they drop, they're yours
New labs every week based on real hacks. Cancel anytime.
Create your account and save your spothunters training
labs from real hacks
completions
paid out for these bugs
The checklist I run on every new target
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
Stop reading about bugs and start hunting them
Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.
No card · free Academy · cancel anytime
