Web
Live web targets from Oct 19, three a day until the lane caught up: recon, IDOR, SQL injection, SSTI, proxy trust, and SSRF.
Day by day
Back Up a Minute
Scoped HTTP reconnaissance, reading robots.txt, exposed directory indexes, backup-file review
STTMPermission to Slip
Authenticated API review, object-level authorization checks, following UI-to-API record references
STTMQuery Me This
GET-parameter testing, SQL query behavior, bounded boolean-based SQL injection
STTMStay in Your Directory
Path traversal, PHP local file inclusion, evidence-led file reads
STTMAdministratively Speaking
Authorization review, framework route inspection
STTMReflect Upon This
Reflected XSS, browser callback analysis, output context
STTMStored for Later
Stored XSS, reviewer workflows, asynchronous evidence
STTMSession Impression
Session fixation, parameter-contract testing, access control
STTMForged With Care
CSRF, state-changing GET review, browser-session behavior
STTMUploading Expectations
Upload validation, MIME and extension mismatch, server-side template rendering
STTMTemplate Temper
Server-side template injection, Spring Expression Language, file-read review
STTMAsk Again Later
Second-order SQL injection, request-contract discovery, differential testing
STTMPosted Too Much
Mass assignment, API property binding, authorization testing
STTMThe API Has Opinions
API inventory, field-level authorization, action/object matrix
STTMFetch Quest
SSRF, internal service discovery from disclosed topology, request scoping
STTMShell Company
Command injection, static binary inspection, bounded target requests
STTMReset Expectations
Password recovery, token/account binding, IDOR
STTMResolver Revolt
GraphQL schema discovery, resolver-level authorization
STTMTrust the Webhook
Webhook trust boundaries, event contract discovery, evidence reconciliation
STTMSerialized Offender
Serialized state manipulation, role binding, format-contract reading
STTMDouble Spent
Business logic, double spend, state-transition testing
STTMSocket to Me
WebSocket authorization, handshake inspection, query-contract testing
STTMForwarded Misgivings
Proxy trust, forwarded-header spoofing, authorization boundaries
STTMFail Open Friday
Fail-open behavior, parser errors, authorization policy enforcement
STTMIf a Breach Falls in a Log
Audit integrity, workflow state, event-log consistency
STTMTrust the Build
Software supply-chain integrity, signature enforcement, update activation
STTMInternal Affairs
SSRF, internal topology, object authorization
STTMPass the Identity
Delegated identity, request-context trust, mixed-target triage
STTMQueue the Confusion
Queue ownership, mass assignment, workflow binding, LFI in mixed Mastery
STTMFramework Roulette
Framework fingerprinting, proxy trust, role-claim authorization, mixed-target triage
STTMFull Stack Incident
Incident reconstruction, SSRF, asynchronous workers, request signing, regression testing
STTM