From the Quartz notes
Labs
These pages keep the figures that explain an idea, and the comparison each lab was for. Solved requests, payload lists, and overlay markup stay in the Quartz vault. Do the keystrokes in an Academy lab.
Client-side
Clickjacking labsFraming labs compare a decoy click with the real control underneath. The overlay markup stays in the Academy lab.
Client-side
CORS labsCORS labs compare the origin you send with the origin the server reflects, and whether credentials are allowed.
Server-side
Access control labsAccess-control labs keep the session still and change one identifier, or keep the identifier and change the session.
Authentication
Authentication labsAuthentication labs separate a wrong password, a missing account, and a guess that never talks to the login.
Server-side
SSRF labsSSRF labs show that the server made the request. The destination list in the vault stays there.
Server-side
SQL injection labsSQL labs compare a baseline row set with a variant that changes what the query returns. The working query stays in the lab.
Server-side
Race condition labsRace labs ask whether two overlapping requests both pass a check that should have allowed one success.
Client-side
WebSocket labsWebSocket labs split the handshake from the frames, and check origin on the handshake before any message.
Client-side
Web LLM labsLLM labs map every input the model reads and every tool it can call. The solved chat transcript stays in the vault.