Choose an application
Six working applications.
One sandbox surface to test them.
Each tile opens a fully-functional product clone — banking, e-commerce, government services, airline, billing, retail. Real forms, real API endpoints, real session state. Every request is authentic traffic for upstream WAF, bot management, DDoS, API security, DAM, and DSF telemetry.
- N01 · Finance
Nordbank
→Personal & business banking
nordbank.thlab.online
- M02 · E-commerce
Marketly
→Everything store
marketly.thlab.online
- G03 · Government
GovGate
→Citizen services portal
govgate.thlab.online
- S04 · Airline
Skyway
→Fly the calm sky
skyway.thlab.online
- P05 · Billing
Payroll
→Invoices & payouts
payroll.thlab.online
- T06 · Retail
Terra Stores
→Neighbourhood retail
terra.thlab.online
6
Applications
Independently themed
30+
Real endpoints
Including 9 vulnerable surfaces
9
Test surfaces
SQLi · XSS · RCE · SSRF · Path · Upload · 3× DDoS
0
Mocked layers
Cookies, sessions, real SQLite