Terms of Service
1. About these terms
These terms apply to your use of HackXpert Labs at labs.thexssrat.com and the labs linked from it (the “Service”), run by The XSS Rat (thexssrat.com), Belgium (“we”, “us”). By creating an account or using the Service you agree to these terms and to our Privacy Policy. If you don't agree, don't use the Service.
2. The Service
HackXpert Labs is a free collection of intentionally insecure web applications for learning and practising ethical hacking and web security. The labs contain real vulnerabilities on purpose. They are training targets, not examples of how to build software. Never reuse lab code in real projects.
3. Your account
- You must be at least 16 years old to create an account.
- One account per person. Give accurate information and keep your login secure.
- You are responsible for what happens under your account.
- You can stop using the Service and ask us to delete your account at any time by emailing support@thexssrat.com.
4. Rules of engagement
In scope: the vulnerabilities built into the labs on labs.thexssrat.com, and the lab applications linked from it. You may use manual testing and security tools (such as Burp Suite, ffuf or sqlmap) at a reasonable rate.
Out of scope. You must not:
- attack the sign-in system (
auth.thexssrat.com/ Auth0), the admin area, or other users' accounts or sessions; - try to get beyond what a lab is designed to expose, for example by compromising the underlying server or operating system, escaping a container, or reaching other services, unless a lab explicitly sets that as its goal;
- use the labs (for example SSRF, RCE or open-redirect labs) to attack, scan, phish or send traffic to any third-party system;
- carry out denial-of-service attacks, or send so much automated traffic that the labs stop working for others;
- deliberately break, deface or lock a lab so that others can't use it;
- mine cryptocurrency, host malware or phishing pages, or store illegal, abusive or infringing content;
- post other people's personal data, or harass other users.
If you find a vulnerability in the platform itself rather than in a lab, report it to support@thexssrat.com and don't exploit it further. We appreciate it.
5. Use your skills legally
The Service is for education. Only test systems you own or have explicit written permission to test. Using techniques learned here against systems without authorisation may be a crime, and you alone are responsible for it.
6. Content you submit
Labs store what you enter, and other users may see it. Don't submit personal data, real credentials or anything you wouldn't want made public. Labs are reset regularly, and we may delete any content at any time.
7. Ads, donations and third-party links
The Service is kept free partly by advertising and voluntary donations. It links to third-party websites, courses and sponsors. We are not responsible for their content or their practices.
8. Suspension and termination
We may suspend or delete accounts, or block access, if these terms are broken, to protect the Service or its users, or if required by law. We may change, pause or end the Service, or any lab, at any time.
9. No warranty
The Service is provided free, “as is” and “as available”, without warranties of any kind. Labs may be unavailable, reset or contain mistakes.
10. Limitation of liability
To the fullest extent permitted by law, we are not liable for any indirect or consequential loss, or for any loss of data, arising from your use of the Service. Nothing in these terms limits liability that cannot be limited by law, including for fraud, gross negligence or intentional misconduct, or your rights as a consumer.
11. Changes
We may update these terms. The date at the top shows when they last changed. If you keep using the Service after a change, you accept the updated terms.
12. Governing law
These terms are governed by Belgian law. This does not take away any mandatory consumer protection you have under the law of the country where you live.