--- title: "AppSec Hands-On Labs for Web and API Security | Cybr" description: "Practice application security with hands-on labs. Test authentication, APIs, injection flaws, server requests, cloud metadata, and web defenses." url: https://cybr.com/hands-on-labs/appsec/ --- Practice application security # AppSec Hands-On Labs Learn application security by testing real vulnerable workloads. Exploit authentication, API, injection, request, and metadata-service flaws, then build defenses. [Start a free AppSec lab →](https://cybr.com/hands-on-labs/lab/breaking-jwt-to-forge-an-admin-token/) No credit card required ![Application security code on a computer screen](https://media.cybr.com/2021/05/luca-bravo-XJXWbfSo2f0-unsplash-624x416.jpg) ![Johnny Endrihs](https://media.cybr.com/2025/12/johnny-endrihs.jpg)![Christopher](https://media.cybr.com/2023/09/christopher-krisnd.jpeg)![Rafael Martinez](https://media.cybr.com/2024/02/rafael-martinez.jpeg)![Lixin Zhang](https://media.cybr.com/2023/07/lixin-zhang.jpeg)![Karan Thakkar](https://media.cybr.com/2025/11/karan-thakkar.png) **80,000+** people learn with Cybr - Real vulnerable workloads - Attack and defense labs - No cloud bill ![Cisco](https://cybr.comhttps//media.cybr.com/2026/08/cisco-light-360.png)![Verizon](https://cybr.comhttps//media.cybr.com/2026/08/verizon-light-360.png)![Toyota](https://cybr.comhttps//media.cybr.com/2026/08/toyota-light-360.png)![Check Point](https://cybr.comhttps//media.cybr.com/2026/08/checkpoint-light-360.png)![Moody’s](https://cybr.comhttps//media.cybr.com/2026/08/moodys-light-360.png)![AT&T](https://cybr.comhttps//media.cybr.com/2026/08/att-light-360.png)![Virginia Tech](https://cybr.comhttps//media.cybr.com/2026/08/virginiatech-light-360.png) Choose a featured AppSec lab ## Test application flaws and build defenses Start with broken authentication, API access, or WordPress exploitation. Then study unsafe server requests and web application firewall protection. 1. Free Free beginner lab ### Breaking JWT to Forge an Admin Token Break a weak JSON Web Token and forge access to an administrator account. Open lab [Breaking JWT to Forge an Admin Token](https://cybr.com/hands-on-labs/lab/breaking-jwt-to-forge-an-admin-token/) 2. Free Free API security lab ### API Gateway Lambda Authorizer Bypass Find and exploit an access-control flaw between API Gateway and Lambda. Open lab [API Gateway Lambda Authorizer Bypass](https://cybr.com/hands-on-labs/lab/api-gateway-lambda-authorizer-bypass/) 3. Free Free WordPress lab ### Hacking WordPress with wp2shell Through a Critical SQLi to RCE Turn a WordPress SQL injection into remote code execution in a guided scenario. Open lab [Hacking WordPress with wp2shell Through a Critical SQLi to RCE](https://cybr.com/hands-on-labs/lab/hacking-wordpress-with-wp2shell-through-a-critical-sqli-to-rce/) 4. Premium Server-side request forgery ### Exploiting Lambda SSRF to Access S3 Buckets Exploit an unsafe server request to reach protected data in Amazon S3. Open lab [Exploiting Lambda SSRF to Access S3 Buckets](https://cybr.com/hands-on-labs/lab/exploiting-lambda-ssrf-to-access-s3-buckets/) 5. Premium Application defense ### Deploy AWS WAF ACL for Application Load Balancer Protect a web workload by deploying an AWS WAF access control list. Open lab [Deploy AWS WAF ACL for Application Load Balancer](https://cybr.com/hands-on-labs/lab/deploy-aws-waf-acl-for-application-load-balancer/) [Browse the complete lab catalog](https://cybr.com/hands-on-labs/) Application security topics ## Build practical AppSec testing skills The AppSec collection covers authentication, API access, injection, server-side requests, cloud metadata, application assessment, and web defenses. ### Test identity, access, and APIs Test weak tokens, authorizers, public function endpoints, application permissions, and serverless attack paths. - [Breaking JWT to Forge an Admin Token](https://cybr.com/hands-on-labs/lab/breaking-jwt-to-forge-an-admin-token/) - [API Gateway Lambda Authorizer Bypass](https://cybr.com/hands-on-labs/lab/api-gateway-lambda-authorizer-bypass/) - [AWS Lambda Function URL Enumeration and Exploitation](https://cybr.com/hands-on-labs/lab/aws-lambda-function-url-enumeration-and-exploitation/) - [Introduction to AWS Lambda Enumeration](https://cybr.com/hands-on-labs/lab/introduction-to-aws-lambda-enumeration/) - [Pentesting AWS Lambda with CloudFox](https://cybr.com/hands-on-labs/lab/pentesting-aws-lambda-with-cloudfox/) - [Bedrock AgentCore Privilege Escalation via Code Interpreters](https://cybr.com/hands-on-labs/lab/bedrock-agentcore-privilege-escalation-via-code-interpreters/) ### Exploit injection and server requests Practice template, file, command, and SQL injection. Then trace unsafe requests into cloud data and credentials. - [Access Environment Variables via Lambda Function with SSTI](https://cybr.com/hands-on-labs/lab/access-environment-variables-via-lambda-function-with-ssti/) - [Access Secrets Manager via Lambda Function with LFI](https://cybr.com/hands-on-labs/lab/access-secrets-manager-via-lambda-function-with-lfi/) - [Exploiting Lambda Command Injection to Access DynamoDB](https://cybr.com/hands-on-labs/lab/exploiting-lambda-command-injection-to-access-dynamodb/) - [Lambda SQL Injection to Access Secrets](https://cybr.com/hands-on-labs/lab/lambda-sql-injection-to-access-secrets/) - [Hacking WordPress with wp2shell Through a Critical SQLi to RCE](https://cybr.com/hands-on-labs/lab/hacking-wordpress-with-wp2shell-through-a-critical-sqli-to-rce/) - [Exploiting Lambda SSRF to Access S3 Buckets](https://cybr.com/hands-on-labs/lab/exploiting-lambda-ssrf-to-access-s3-buckets/) - [S3 Data Exfiltration via EC2 IMDSv1](https://cybr.com/hands-on-labs/lab/s3-data-exfiltration-via-ec2-imdsv1/) - [Compromising EC2 IMDSv2 with RCE to Access Sensitive S3 Data](https://cybr.com/hands-on-labs/lab/compromising-ec2-imdsv2-with-rce-to-access-sensitive-s3-data/) ### Find and block application weaknesses Assess serverless applications for vulnerable code and protect web traffic with a web application firewall. - [Find Vulnerable Lambda Functions with Amazon Inspector](https://cybr.com/hands-on-labs/lab/amazon-inspector-sandbox/) - [Deploy AWS WAF ACL for Application Load Balancer](https://cybr.com/hands-on-labs/lab/deploy-aws-waf-acl-for-application-load-balancer/) Free cheat sheets ## Cloud security cheat sheets for AWS applications References for understanding application permissions, restricting access to cloud data, and responding to exposed AWS credentials. - [AWS IAM policy anatomy cheat sheet](https://cybr.com/cheat-sheets/iam-policy-anatomy/) Read the role permissions behind a vulnerable workload to understand why an application exploit can reach other AWS services. - [Least-privilege S3 bucket policy cheat sheet](https://cybr.com/cheat-sheets/s3-least-privilege/) Bucket-policy examples for restricting application access to S3 data and identifying excessive permissions. - [IAM credential exposure incident response playbook](https://cybr.com/cheat-sheets/iam-credential-exposure/) Study the response steps for AWS credentials exposed through an application vulnerability or metadata-service attack. [Browse all cloud security cheat sheets](https://cybr.com/cheat-sheets/) How the labs work ## Practice application attacks without risking production Cybr prepares the vulnerable environment for each lab. You can focus on the security task instead of setup, billing, and cleanup. 1. Step 01 ### Choose an AppSec lab Start free or choose a premium scenario that matches your experience. 2. Step 02 ### Launch the environment Get the vulnerable workload, cloud resources, access, and instructions that the lab requires. 3. Step 03 ### Complete the scenario Test or defend the application and review how the weakness affects connected resources. **Isolated security training environments** Practice without changing personal or company resources. Cybr provides the lab environment and covers its cloud costs. Continue with a career roadmap ## Build the skills of an application security engineer Connect these labs to software, networking, testing, secure development, and cloud security skills in the AppSec career path. - [Application Security Engineer](https://cybr.com/career-paths/application-security-appsec-engineer/) Follow a career roadmap through security foundations, application testing, secure development, and professional skills. Go deeper with AppSec training ## Connect individual labs with application security courses Start with application security foundations, then study injection methods, testing tools, and secure software practices in focused courses. [View the Introduction to AppSec course →](https://cybr.com/courses/introduction-to-application-security-appsec/) [View the Injection Attacks guide](https://cybr.com/courses/injection-attacks-the-free-guide/) Before you start ## AppSec hands-on lab FAQ Can I try an AppSec lab for free? Yes. Selected AppSec labs are free. Create a free account and start without a credit card. [Start a free AppSec lab](https://cybr.com/hands-on-labs/lab/breaking-jwt-to-forge-an-admin-token/) Do I need my own cloud account? No. Cybr supplies the vulnerable environment and lab access. Your personal and company cloud accounts stay separate. How much application security experience do I need? Beginners can start with token or API flaws. Later labs cover injection, cloud metadata, remote code execution, assessment, and defenses. What AppSec skills can I practice? Labs cover authentication, API access, serverless applications, template injection, file inclusion, command injection, SQL injection, request forgery, assessment, and web firewalls. Why do these AppSec labs use AWS services? Modern applications often use APIs, functions, object storage, and managed databases. The labs show how software flaws can expose those connected services. Will cloud providers charge me for lab resources? No. Cybr provides the lab environment, covers its cloud costs, and removes the resources after your session. ## Start an application security lab for free Break a weak token in a guided environment, then continue through API, injection, cloud, and defense scenarios. [Start a free AppSec lab →](https://cybr.com/hands-on-labs/lab/breaking-jwt-to-forge-an-admin-token/) [Explore the AppSec career path](https://cybr.com/career-paths/application-security-appsec-engineer/) No credit card required