Master the Vulnerabilities.
Verify the Systems.
Production-grade cybersecurity practice range spanning 5 core domains. Interactive sandboxes, real target boxes, and native integration with the Vector testing workbench.
Broken Object Level Authorization (BOLA)
Tamper with user GUID parameters across REST profile endpoints in Vector's Probe workbench to extract unauthorized financial records.
HTTP Request Smuggling (CL.TE Desynchronization)
Exploit front-end and back-end header boundary desync to smuggle hidden requests into the pipeline and hijack active user sessions.
Android Dynamic SSL Pinning Bypass
Decompile an obfuscated APK, write a custom Frida script targeting TrustManager implementations, and route mobile traffic into Vector.
Biometric Authentication Callback Override
Hook BiometricPrompt callbacks at runtime to force authorization success without valid fingerprint or face verification.
Windows DLL Search-Order Hijacking
Identify missing DLL search vectors in a privileged desktop agent and plant a crafted proxy DLL to execute code under elevated permissions.
Insecure Named Pipe SYSTEM Privilege Escalation
Audit the DACL of an endpoint service named pipe, discover insecure command dispatching, and trigger arbitrary command execution as SYSTEM.
GraphQL Introspection & Broken Function Auth
Reconstruct the full GraphQL schema from an enabled introspection endpoint, uncover unlisted administrative mutations, and escalate privileges.
Unauthenticated gRPC Service Reflection
Interact directly with internal gRPC microservices via reflection, decode Protobuf payloads, and bypass edge gateway authentication checks.
Active Directory AS-REP Roasting & Kerberos TGT
Identify domain accounts with pre-authentication disabled, request AS-REP ticket hashes over Kerberos, and crack passwords offline.
AD CS ESC1 Certificate Template Abuse
Exploit client authentication certificate templates with SAN flags enabled to request certificates on behalf of the Domain Controller.
The Complete Pratimāna Security Lifecycle
1. Learn on Lattice
Master vulnerability mechanics, practice with hands-on target sandboxes, and build verifiable skills across 5 domains.
2. Test with Vector
Download Vector, our high-speed desktop intercepting proxy and testing workbench, engineered in Rust for precision testing.
3. Hunt on Matrix
Graduate to hunting real vulnerabilities on enterprise assets through Matrix's coordinated bug bounty and disclosure platform.