Test identity, access, and APIs
Test weak tokens, authorizers, public function endpoints, application permissions, and serverless attack paths.
Practice application security
AppSec Hands-On Labs
Learn application security by testing real vulnerable workloads. Exploit authentication, API, injection, request, and metadata-service flaws, then build defenses.
No credit card required
70,000+ people learn with Cybr
- Real vulnerable workloads
- Attack and defense labs
- No cloud bill
Choose a featured AppSec lab
Test application flaws and build defenses
Start with broken authentication, API access, or WordPress exploitation. Then study unsafe server requests and web application firewall protection.
FreeFree beginner labBreaking JWT to Forge an Admin Token
Break a weak JSON Web Token and forge access to an administrator account.
Open lab
FreeFree API security labAPI Gateway Lambda Authorizer Bypass
Find and exploit an access-control flaw between API Gateway and Lambda.
Open lab
FreeFree WordPress labHacking WordPress with wp2shell Through a Critical SQLi to RCE
Turn a WordPress SQL injection into remote code execution in a guided scenario.
Open lab
PremiumServer-side request forgeryExploiting Lambda SSRF to Access S3 Buckets
Exploit an unsafe server request to reach protected data in Amazon S3.
Open lab
PremiumApplication defenseDeploy AWS WAF ACL for Application Load Balancer
Protect a web workload by deploying an AWS WAF access control list.
Open lab
Application security topics
Build practical AppSec testing skills
The AppSec collection covers authentication, API access, injection, server-side requests, cloud metadata, application assessment, and web defenses.
Exploit injection and server requests
Practice template, file, command, and SQL injection. Then trace unsafe requests into cloud data and credentials.
- Access Environment Variables via Lambda Function with SSTI
- Access Secrets Manager via Lambda Function with LFI
- Exploiting Lambda Command Injection to Access DynamoDB
- Lambda SQL Injection to Access Secrets
- Hacking WordPress with wp2shell Through a Critical SQLi to RCE
- Exploiting Lambda SSRF to Access S3 Buckets
- S3 Data Exfiltration via EC2 IMDSv1
- Compromising EC2 IMDSv2 with RCE to Access Sensitive S3 Data
Find and block application weaknesses
Assess serverless applications for vulnerable code and protect web traffic with a web application firewall.
Free cheat sheets
Cloud security cheat sheets for AWS applications
References for understanding application permissions, restricting access to cloud data, and responding to exposed AWS credentials.
- AWS IAM policy anatomy cheat sheet
Read the role permissions behind a vulnerable workload to understand why an application exploit can reach other AWS services.
- Least-privilege S3 bucket policy cheat sheet
Bucket-policy examples for restricting application access to S3 data and identifying excessive permissions.
- IAM credential exposure incident response playbook
Study the response steps for AWS credentials exposed through an application vulnerability or metadata-service attack.
How the labs work
Practice application attacks without risking production
Cybr prepares the vulnerable environment for each lab. You can focus on the security task instead of setup, billing, and cleanup.
- Step 01
Choose an AppSec lab
Start free or choose a premium scenario that matches your experience.
- Step 02
Launch the environment
Get the vulnerable workload, cloud resources, access, and instructions that the lab requires.
- Step 03
Complete the scenario
Test or defend the application and review how the weakness affects connected resources.
Isolated security training environments
Practice without changing personal or company resources. Cybr provides the lab environment and covers its cloud costs.
Continue with a career roadmap
Build the skills of an application security engineer
Connect these labs to software, networking, testing, secure development, and cloud security skills in the AppSec career path.
- Application Security Engineer
Follow a career roadmap through security foundations, application testing, secure development, and professional skills.
Before you start
AppSec hands-on lab FAQ
Can I try an AppSec lab for free?
Yes. Selected AppSec labs are free. Create a free account and start without a credit card. Start a free AppSec lab
Do I need my own cloud account?
No. Cybr supplies the vulnerable environment and lab access. Your personal and company cloud accounts stay separate.
How much application security experience do I need?
Beginners can start with token or API flaws. Later labs cover injection, cloud metadata, remote code execution, assessment, and defenses.
What AppSec skills can I practice?
Labs cover authentication, API access, serverless applications, template injection, file inclusion, command injection, SQL injection, request forgery, assessment, and web firewalls.
Why do these AppSec labs use AWS services?
Modern applications often use APIs, functions, object storage, and managed databases. The labs show how software flaws can expose those connected services.
Will cloud providers charge me for lab resources?
No. Cybr provides the lab environment, covers its cloud costs, and removes the resources after your session.
Start an application security lab for free
Break a weak token in a guided environment, then continue through API, injection, cloud, and defense scenarios.
No credit card required