Realistic enterprise surface
Public website, multi-tenant client portal, staff backoffice and a REST API, with distinct roles and organizations sharing one platform.
An environment built to be tested.
PentAIO Labs simulates a real software company with known weaknesses and out-of-band telemetry — built for manual testing, automated tools, and PentAIO ATLAS.
The target
A complete company, not a list of challenges.
Real applications are layered: public pages, tenants, roles and business rules that interact. The lab reproduces that structure so the hard part — understanding the system — is part of the test.
Controlled weaknesses
Authorization, injection and business-logic flaws that can be enabled or mitigated per evaluation. A fully secure baseline tests for false positives, too.
Ground truth, recorded
Every request is observed outside the target. Findings are scored against what is actually there: confirmed, false positive or missed.
Method
How an evaluation works.
The same structure in every assessment, whether you test manually, with your own tools, or with automated agents.
Start from the public surface
Every assessment begins at the public website and exposed endpoints, with no prior hints or internal access.
Explore and exploit
Map roles, business logic and attack paths through reconnaissance, hypotheses and controlled exploitation.
Observe out of band
Telemetry is recorded outside the target's network. The application cannot see or alter the observer.
Verify against ground truth
Each finding is checked against the lab's real state and concrete evidence, filtering out false positives.
Rules of engagement
Test freely. Stay in scope.
The lab exists to be attacked. These rules keep it available for everyone and keep the measurements meaningful.
Permitted
- Manual and automated testing of lab.pentaio.tech
- Exploiting application weaknesses to obtain evidence
- Evaluating your own tools and agents
Not permitted
- Denial of service or high-volume traffic
- Targeting pentaio.tech, the hosting provider or any other system
- Pivoting beyond the application, social engineering or spam
All data in the lab is synthetic. Activity is logged and the environment may be reset at any time. By testing you accept the acceptable use policy.
Contact & Suggestions
Questions, scenario suggestions, or feedback about PentAIO Labs.
The lab is open.
Start from the public website, as any assessment would. Everything else is up to you.