This is a Vulnerable Lab

ratnews.thexssrat.com is an intentionally vulnerable web application built by The XSS Rat as a safe, legal environment for practising offensive security techniques. You have explicit permission to attack this application. Do not use what you learn here against systems you do not own.

Why this lab exists

Real bug bounty hunters and penetration testers need live targets to sharpen their skills. This lab mirrors a realistic content-delivery stack — a FastAPI app with a database, user accounts, an admin API, and RSS aggregation — so you can practise against something that behaves like a real application, document your findings, and build a repeatable methodology without any legal risk.

What vulnerabilities are hidden here

→Reflected & Stored XSS — unsanitised user input rendered in the browser
→SQL Injection — boolean-based blind injection in search and filter endpoints
→SSRF — server-side request forgery via RSS feed ingest
→IDOR — insecure direct object references in user and preference endpoints
→Auth bypass & API key exposure — weak admin token enforcement and session manipulation
→Open redirect — unsafe next parameter handling after login
→Enumeration & recon surfaces — exposed FastAPI docs, predictable endpoints, and verbose errors

View full mission briefing →

Hacking News Lab

Lab Mission Toolkit CTF Calendar Bug Bounty Radar Target Aggregator

Create your mission profile

Display name

Password

Use at least 8 characters. This account stays in the lab — no social logins or external sync.

Subscribe to mission themes

cloud web mobile supply chain osint malware defense

Pick as many as you like — you can change these later from your subscriptions page.

Already have an account? Log in.

Built with FastAPI • The XSS Rat