WebVerse
Herbalist Remedies
Herbalist Remedies — an herbal-blend catalog — trusts its login form to compare MongoDB query objects. Slip an operator in and see who else is home.
Minatour
WebVerse
Trace Control
Trackboard, an internal issue tracker, rolled to production with display_errors accidentally left on. Its /issues page has a numeric id param and a loose sense of type safety. Coax a database error to tell you what you need.
WebVerse
SwiftSearch Hotels
SwiftSearch's hotel API accepts a JSON filter body that's merged straight into a MongoDB-style query. Ordinary users filter by city and price; operators slip in just as easily.
WebVerse
Voucher Vault
Redzone Rewards — an internal employee rewards portal — exposes a voucher search that concatenates user input straight into a SELECT. Find the hidden administrative voucher.
WebVerse
Ember Kettle
A small tea shop's brand-new online catalog has a search bar that trusts everything you give it. No filter, no escape, no second thoughts.
WebVerse
Shadow Registrar
RegistryPro's WHOIS terminal returns three things: a status word, a reflected domain name, and a lookup time. The query layer accepts stacked statements. Everything you need leaks through the clock.
WebVerse
DocketHive
Assess the DocketHive event ticketing platform. Register, poke around, and see what you can read.
WebVerse
Traverse
Traverse Docs' knowledge base. A clean documentation site — but how does it serve those pages under the hood?
WebVerse
Corridor
A small literary press publishes their quarterly journal online. Every piece — story, essay, poem — lives on disk as a page fragment. When you click through to read one, the server fetches that fragment and assembles the page. The path handling is… not careful.
WebVerse
Overdue
A small-town library moved its catalog online last week. Sign in and have a look around.
WebVerse
Furrow
Assess the YieldPulse precision agriculture platform. Register an operator account, explore the API, and follow the data wherever it leads.
WebVerse
Schematic
Schematic Inc's internal product dashboard. The frontend shows you what they want you to see — what's behind it?