LLZ · the bible

Z Guide

Welcome to the Lab Lounge handbook. Alphabet soup decoded, booths mapped, console unlocked, ethics intact. Read what you need, skip what you know — and when in doubt, ask Caleb after you read the booth.

Jump to TOC Back to Lounge Authorized minds only

01Alphabet soup

We name things like a LAN party that got a business license. Here’s the decoder ring:

LLZ: LabZocial — the community brand — and the flag format LLZ{…} you submit at stations.
LLC: Laden Lab Console — your private browser workstation (backtick to open).
LLO: Oracle — GitHub-backed knowledge search at /oracle/.
LLG: Gear — merch + token desk at /gear/ (alias /store/).
LLT: Laden Lab Tokens — 1 LLT = 1 NOK (demo economy for hints, skins, weekly drop).
LLA: Admin console at /lla/ — operators with admin only.
LLD: Developer opt-in — arcade & sandbox toys at /lld/ after you tick the box on Account.
LLN: LabNewz — news tab inside Community.

Lab Lounge is the member den at /labs/. Laden Lab'z is the brand. Legal entity: Laden AS, Org.nr. 937 285 833, Oslo.

02Getting in

Create an account, log in, register, or reset a password at /account/.

Use https://laden.no. Plain HTTP login fails on purpose — TLS or bust.

Lab ID card — desktop: hover Login / your name. Mobile: tap when logged in.
Session — token lives in localStorage. Clear site data = logout vibes.
Guests — browse public pages; play 3 free stations (see Lounge). Members get the full board, forum, DMs, Gear spends, and LabZocial posting.

03Homepage

Public front door at /: brand story, free-challenges rotator, Cart in the nav, and a loud CTA into the Lounge. Peek, then badge up.

04Lab Lounge `/labs/`

The member den. Soft neon, station board, track knobs, search, and views for forum / gear / leaderboard. Ambient strip keeps the room feeling live. Live wire shows recent ops. Manuals and (hello) this Z Guide get featured panels. Merch strip teases Gear. Booth rail jumps to Manuals + Z Guide. Ask Caleb when the trail goes cold.

Flags look like LLZ{…}. Guests can still play three free stations from featured.js:

scope-first — Scope First
robots-redux — Robots Redux
reflect-101 — Reflection 101

Everything else wants a badge. Claim one at Account, then come back for the full board.

05All 24 challenge stations

Grouped by track. Paths are /labs/<slug>/. Difficulty · points · one-line learn.

gateway

Slug	Title	Diff	Pts	You’ll learn
scope-first	Scope First	easy	25	Written permission beats curiosity — always start with scope.

recon

Slug	Title	Diff	Pts	You’ll learn
banner-grab-lite	Banner Whisper	easy	40	Service banners leak version intel — listen before you poke.
robots-redux	Robots Redux	easy	50	`robots.txt` is a map, not a wall.
hidden-dir	Hidden Directory	easy	60	Directory discovery finds what nav forgot.
js-secrets	JS Secret Sprawl	med	105	Client-side JS loves leaking keys — rotate what you find.

web

Slug	Title	Diff	Pts	You’ll learn
reflect-101	Reflection 101	easy	70	Reflected XSS basics — input comes back mean.
cookie-jar	Cookie Jar	easy	55	Cookie flags & trust boundaries matter.
csp-bypass-talk	CSP Conversations	hard	160	Content-Security-Policy is a dialogue, not a force field.

auth

Slug	Title	Diff	Pts	You’ll learn
jwt-none	alg=none Nightmares	med	120	Never trust JWT `alg` from the client.
idor-desk	IDOR Desk	med	110	Object IDs without authz checks = someone else’s desk.
password-reset-poison	Host Header Trust	med	130	Host headers in reset links are poisonable.
rate-limit	Rate Limit Reality	easy	60	Throttles exist; bypasses teach why.

inject

Slug	Title	Diff	Pts	You’ll learn
sqli-logic	SQLi Logic Gate	med	140	Boolean / logic SQLi without fireworks.
cmd-metachar	Metacharacters	med	125	Shell metacharacters turn “ping” into “oh no.”

crypto

Slug	Title	Diff	Pts	You’ll learn
b64-again	Encoding ≠ Encryption	easy	50	Base64 is wrapping paper, not a vault.
rot-warm	Caesar Warmup	easy	45	ROT / Caesar — warm hands before harder crypto.
hash-id	Hash Identification	med	90	Name the digest before you crack the digest.

network

Slug	Title	Diff	Pts	You’ll learn
cors-wild	CORS Wildcards	med	100	Wildcard CORS + credentials = bad party.
open-redirect	Open Redirect	easy	65	Unvalidated redirects phish with your domain’s trust.
tls-old	TLS Time Capsule	easy	40	Old TLS / weak ciphers are museum pieces — find them.

cloud

Slug	Title	Diff	Pts	You’ll learn
ssrf-mind	SSRF Mindset	hard	180	Server-side fetches that trust user URLs go places.
path-traversal	Traversal Taste	med	115	`../` still works when paths aren’t normalized.

practice

Slug	Title	Diff	Pts	You’ll learn
report-quality	Report Like a Pro	easy	35	Steps, impact, fix — reports that earn trust.
cvss-feel	CVSS Feel	med	80	Severity scoring that feels right, not theatrical.

06How to work a station

Open a booth from the Lounge board (or /labs/<slug>/).
Read the brief — scope, goal, hints exist for a reason.
Hunt ethically inside the demo — don’t spray production, don’t pivot off-scope.
Submit the flag LLZ{…} for XP.

These are teaching labs. PoC, not pwn. If you’re stuck, ask Caleb — after you’ve actually read the booth.

07LLC console

Your private workstation in the browser. Open it with:

Backtick ` — works with Norwegian AltGr layouts too
Floating llc$ control, or the bottom Console tab on mobile
/labs/?llc=1 or /terminal/

Prompt looks like user@llc. Home is /z/labz/<user> with Documents / Downloads. Sessions persist until you clear. Nets are fictional only (labnet 10.13.37.0/24 and friends) — never point scanners at the real internet.

Command groups

Filesystem — pwd ls cd cat head tail tree find mkdir touch rm rmdir cp mv echo grep
Z Drive — df / zquota, zshare, zunshare
Networks — ip ifconfig iwconfig iw labcrack-ng*
Scanners — lmap, mzfconsole
Helpers — curl wget base64 rot13 xxd jwt hashid (+ md5/sha*)
Session — help hint clear whoami id uname manuals

Deep docs live at /labs/manuals/. In LLC, type manuals or man <tool>. Type zguide or bible for this page.

08Manuals

/labs/manuals/ — one page per LLC tool, with filter chips (Filesystem, Z Drive, Networks, Scanners, Helpers, Session). Syntax matches the live console. Fiction-marked tools stay on lab nets.

09Community `/community/`

LLZ LabZocial feed, friends, and profiles at /community/u/<user>/ and /zocial/<user>/. Tabs include LabNewz (LLN) and Tips (detail pages under /tips/). Guests can read; members post, react, and friend.

10Tips (16)

Short operator tips — tool workflows that keep labs honest. Path: /tips/<slug>/.

aircrack-own-apOwn AP / own handshake airmon-check-killairmon-ng check kill burp-loggerLogger++ / Logger tab burp-match-replaceMatch and replace ffuf-filter-smartFilter smart hashcat-mode-numbersMode numbers matter hydra-throttleThrottle or get banned john-format-detectionFormat detection msf-search-infosearch + info before exploit msf-workspacesWorkspaces keep you honest nmap-host-discoveryHost discovery first nmap-scripts-versionsScripts + versions without -A sqlmap-dump-intentDump with intent sqlmap-level-riskLevel/risk deliberately wireshark-follow-streamFollow the stream wireshark-http-postsHTTP POSTs only

11Oracle (LLO) `/oracle/`

GitHub-backed knowledge search. Ask a question; Caleb interprets the hits into human. Great for “what’s the writeup pattern?” — not a substitute for opening the booth.

12Gear (LLG) `/gear/`

Merch demo cart (alias /store/). Spend LLT on hints, skins, and the weekly drop. Cart lives in the nav. Demo money — no real charges. 1 LLT = 1 NOK in the fiction.

13Messages `/messages/`

Member DMs. LLA can drop warnings / tokens here. Login required — guests get the door, not the inbox.

14Forum `/forum/`

Member forum — also available as a Lounge view. Talk shop, spoilers behind your brain, be excellent.

15Account `/account/`

Dashboard after login:

Lab ID card, XP / LLT balances
Daily Caleb cheer
LabZocial profile editor (online / search / pentest prefs)
Avatar shop (~100 LLT), labcard skins (~10 LLT), title shop
LLD opt-in checkbox + Save — unlocks Developer toys
Language toggle EN / NO (Account only — product names stay English; quotes stay original)
Logout · LLA entry if you’re admin

16LLD Developer `/lld/`

Hidden until you opt in on Account and Save. Then a Lounge CTA can show dev. Arcade with FuckFuckem / FPS game, plus manuals / sandbox links. Toys for builders — still fictional scope.

17LLA Admin `/lla/`

Admin console for admins only. If you don’t have the badge, you don’t have the room. That’s the feature.

18Challenges page `/challenges/`

Public challenge listing and earn-LLT path. Marketing front for the same stations that live in the Lounge.

19Mobile (≤900px)

App chrome with bottom tabs: Home · Lounge · Console · Community · More.

More sheet — Forum, Gear, Oracle, Challenges, Messages, Account, Tips, Z Guide…
Guest Login tap → Account
Member tap → Lab ID card
LLC drawer runs taller so you can actually type

20Caleb

Floating FAB mentor + Ask Caleb buttons around the site. He’s the lounge sage, not a spoilers bot and not a substitute for reading the booth. Ask after you’ve tried.

21Language (EN / NO)

Toggle on Account. UI copy can flip; nav and product names stay English. Quotes and challenge prose stay in their original language. One brain, two labels.

22Workarounds / FAQ

Use https://laden.no. HTTP login is allergic to itself.

Page looks haunted after a deploy?

Hard-refresh (Ctrl/Cmd+Shift+R). Caches love old ghosts.

Backtick won’t open LLC?

Norwegian layouts: AltGr + the key that makes `. Or tap Console / floating llc$.

Only three stations?

You’re a guest. Badge up for the full board — free trio is scope-first, robots-redux, reflect-101.

Where’s LLD / “dev.”?

Account → LLD opt-in checkbox → Save. Then the Lounge CTA can appear.

Lab ID card off-screen?

Desktop: hover Login / your name. Mobile: tap Login / name when logged in.

Z Drive full?

Quota is real-ish (~10 MB fiction). Clean Downloads, unshare, try again.

Can I scan the real internet from LLC?

No. Fictional nets only. Pointing scanners at live hosts is how you leave the lounge the hard way.

Golden rule?

Scope first. Always. Written permission beats curiosity.

23Ethics closer

Authorized minds only. Written permission. PoC not pwn. Stop at proof. Don’t pivot without approval. These booths teach bug classes — they are not a license to practice on strangers.

Laden AS · Org.nr. 937 285 833 · Oslo

You made it to the end of the bible. Now go open a booth — or type manuals in LLC and geek out responsibly.

Enter the Lounge LLC Manuals Back to TOC