Vue + webedge-db security lab

Security training usually marks a lab done from a writeup, so you can "solve" it without ever landing the exploit — and generic academies do not cover Vue/webedge-db-specific sinks.

Most security training marks a lab done from a writeup, so you can pass by describing an exploit you never actually landed. And generic academies teach against generic apps, not the exact stack we build on. Hackbox is a security academy for the Vue 3 + webedge-db stack where a lab only counts when the exploit really fires.

A local academy for the Vue 3 + webedge-db + Tailwind stack where a lab only counts when the exploit actually fires: XSS and `javascript:` URLs really execute in the browser (a beacon catches alert/print and `window.__hackbox.fire()`), SSRF runs through a mock internal network with a real URL resolver and egress allowlist, and IDOR, over-posting, JWT alg=none, prototype pollution and more are auto-detected from the real request outcome; attempts, sessions and hints are recorded in webedge-db, with Vitest covering the detectors.

A local academy modelled on the best hands-on courses: learning paths, a topic map, lab briefs, a session timer, hints, a notebook, markdown report export, a mystery mode, a practice exam and a Hall of Fame. But the core idea is solved-by-exploit: XSS and javascript: URLs really execute in the browser (a beacon catches alert/print and window.__hackbox.fire()), SSRF runs through a mock internal network with a real URL resolver and an egress allowlist re-checked on every hop, and IDOR, over-posting, JWT alg=none, prototype pollution and the rest are auto-detected from the real outcome of a request.

Built with Vue 3, webedge-db, Security labs.

Vue 3 (script setup) + webedge-db + Tailwind v4; a schema for lab attempts, sessions and learner progress; some labs ship bespoke target apps while others share a renderer with the same real auto-detect; Vitest covers the security helpers, checkers, catalog integrity, the exploit auto-detect engine, the SSRF mock network and e2e target runs; deployed on Cloudflare Pages with our own backend.

Every OWASP Top 10 (2021) category has at least one lab verified by a real, reproducible exploit rather than keyword-matching a report — with the stack's own Vue and webedge-db sinks as the target.

A security academy where you cannot pass a lab you did not actually break, aimed squarely at the Vue + webedge-db stack we ship — so the practice is against our own real weak spots, not a textbook.