Leethack hands you the vulnerable function and the exact exploit suite that broke it in the wild. Read the flaw, write the patch, submit — and watch every attack vector run against your code in real time.
Fix the vulnerable function. Prove the fix holds against the full exploit suite.
Write the payload that bypasses the code. Same challenge, attacker role.
Review a codebase for latent vulnerabilities before they ship.
Every challenge traces to a real vulnerability. The harness runs the same exploit vectors the original CVE used.
The verifyJWT function trusts the algorithm from the token header. Swap it to "none" to forge arbitrary tokens without a valid signature.
function verifyJWT(token, secret) { const [head, body, sig token
The OWASP Progress Map shows exactly where your gaps are. Work A01 through A10 in order. Know when you're ready.
View all categories| # | handle | XP | rank |
|---|---|---|---|
| 1 | 0xkira_sec | 12,847 | top 1% |
| 2 | null_byte | 11,203 | top 2% |
| 3 | s3rv3r_s1de | 9,921 | top 5% |
| 4 | patch_wizard | 8,445 | top 9% |
| 5 | mem0ry_safe | 7,132 | top 14% |
| — | you | 0 | unranked |
No card required. Pick a challenge, write the fix, watch it survive the exploit suite.
| 0247 | JWT Algorithm Confusion | Medium |
| 0312 | Cloud Metadata SSRF | Hard |
| 0189 | DOM XSS via innerHTML | Medium |
| 0421 | Permissive CORS Headers | Easy |
| 0388 | Insecure Deserialization | Hard |
Ranked against every candidate who has ever touched the platform. Your percentile tells interviewers more than your resume can.