🌐Web ExploitationInsane 5000 XP 9 solves 90 min Exclusive badge on solve

BlackVault Banking

by Codelivly

BlackVault is a private-banking portal with a full attack chain and TWO flags — treat it like a mini pentest, not a single bug. Start with recon, read what the frontend leaks, then chain a database flaw and a token weakness to reach the admin console. FLAG 1 (User) lives in the member API; FLAG 2 (System) lives behind the admin diagnostics. Your own isolated instance — flags are unique to you, so they can't be shared. Submit each flag in the box; capture both to complete the challenge.

#insane#multi-flag#kill-chain#recon#information-disclosure#jwt#sql-injection#broken-access-control#web

DifficultyInsane

Live Environment

Ready

Spin up your own private, isolated instance of this challenge.

Auto shutdown after 60 minutes
Isolated sandbox
Captured flags are saved independently of the environment
One-click restart

Flags · 0/2 captured

1User Flag2000 XP
2System Flag3000 XP

Submit each flag below — the box accepts any of them.

Submit Flags

Hints

Unlocking any hint — including free ones — forfeits the +25% no-hint solve bonus.

Hint 1

Hint 2

Hint 3

Hint 4

Challenge List

Frequently Asked Questions

What does the BlackVault challenge cover?

It follows a full attack chain: reconnaissance, information disclosure, JWT problems, SQL injection and broken access control, each tied to a flag.

How should I prepare for it?

Complete easier challenges on each topic first, keep notes on every finding, and test how one discovery enables the next step.

Is BlackVault Banking free?

Yes. It is an insane multi-flag challenge on Codelivly, free to attempt, and it works well as a final test of web exploitation skills.

NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a labCodelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us