A hands-on attack / detection / defence workshop. Everything below is deliberately vulnerable and exists only for the duration of this session.
The IdP is configured correctly on purpose — every weakness you will find lives in the client applications.
| Kanidm | kanidm.lab.quokkahost.com |
|---|---|
| Log viewer (Seq) | logs.lab.quokkahost.com |
| Module | Focus | App |
|---|---|---|
| 1 | Follow the token | follow-token.lab.quokkahost.com |
| 2 | Consent phishing | phish-saas.lab.quokkahost.com |
| 3A | Missing state | vuln-state.lab.quokkahost.com |
| 3B | Weak redirect URI | vuln-redirect.lab.quokkahost.com |
| 3C | Missing PKCE | pkce-good.lab.quokkahost.com / pkce-bad.lab.quokkahost.com |
| 3D | Token leakage | token-leak.lab.quokkahost.com |
| 5 | OIDC attacks | vuln-oidc.lab.quokkahost.com |
| 3E | MCP confused deputy | mcp-client.lab.quokkahost.com / mcp-gateway.lab.quokkahost.com |
| — | Corporate resource API | resource-api.lab.quokkahost.com |
| — | The attacker's machine | attacker.lab.quokkahost.com |
Sign in only as the lab users your instructor gave you. These hosts are on the public internet, they log everything, and several of them hand your tokens straight to an “attacker”.