Duck store: intentionally vulnerable website!

Project #2 of 5 in "Web Security" progression
Duck store: intentionally vulnerable website! thumbnail

Updated: Feb 23, 2026

In this project

Wanna become the best cyber guardian of all time? Meet Duck Store - website you need to hack. 

Surprised? Well, at the beginning of their careers, most white hat specialist were hackers first. And you will be too.   

Learning plan

  1. Meet Duck Store: intentionally vulnerable website

  2. Full vulnerabilities list

  3. Scan the website tech stack using Wappalyzer

  4. Business logic flow: negative items quantity

  5. 100% off coupons: Coupon Information Disclosure

  6. Shipping Cost Bypass: level 1

  7. Shipping Cost Bypass: level 2

  8. Referral Code Abuse: account farming

  9. A mental model of XSS attack

  10. Setting up an XSS mine in testimonials

    1. Send a user access token to yourself!

  11. This shouldn't work: IDOR in testimonials

  12. I gol all of your users: user enumeration

  13. Sniffing user data: User Enumeration + IDOR chain

  14. IDOR in orders: see placed orders you don't own

  15. Uplifting user priviledges with mass Assignment

  16. How SQL injections work: playground

  17. Tricky SQL injection using sqlmap

  18. Brute Force attack with No Rate Limiting: weak admin credentials

  19. JWT alg:none - becoming the admin of the website

  20. getendpoints: javascript bookmarklet injection

  21. SSRF: Link Preview

  22. SSRF: Image Import

  23. Open Redirect

  24. 2FA Bypass

Duck store: intentionally vulnerable website!