Step 1: Install XAMPP#

XAMPP gives you Apache, MySQL, PHP, and phpMyAdmin in one package. This is the easiest way to start.

1. Download XAMPP
   • Go to https://www.apachefriends.org/
   • Click the download button for Windows

1. Run the installer

   • Double-click the file you downloaded
   • If Windows shows a warning, click “More info” then “Run anyway”

2. Choose what to install

   • Select these: Apache, MySQL, PHP, phpMyAdmin
   • You don’t need the other things

3. Choose where to install

   • Use the default: C:\xampp
   • Do NOT install in “Program Files” (it can cause problems)

4. Finish the installation

   • Wait for it to complete
   • Click “Finish”

Step 2: Start the Services#

1. Open XAMPP Control Panel

   • Right-click on it and choose “Run as administrator”
   • You can find it at C:\xampp\xampp-control.exe

2. Start Apache and MySQL

   • Click “Start” next to Apache
   • Click “Start” next to MySQL
   • Both should turn green

3. Check it works
   • Open your browser
   • Go to http://localhost
   • You should see the XAMPP welcome page

Step 3: Install MySQL Workbench (Optional)#

MySQL Workbench is a nice program to manage your databases. It’s not required, but it helps.

1. Download it

   • Go to https://dev.mysql.com/downloads/workbench/
   • Choose “Windows (x86, 64-bit), MSI Installer”
   • Click “No thanks, just start my download”

2. Install it

   • Run the file you downloaded
   • Follow the steps
   • Choose “Complete” installation

3. Connect to your database

   • Open MySQL Workbench
   • Click the + button to add a new connection
   • Use these settings:

1
Connection Name: XAMPP Local
2
Hostname: localhost
3
Port: 3306
4
Username: root
5
Password: root

4. Test it
   • Click “Test Connection”
   • You should see a success message
   • Click “OK” to save

Step 4: Set Up phpMyAdmin#

phpMyAdmin is already included with XAMPP. You can access it at http://localhost/phpmyadmin.

1. Open phpMyAdmin
   • Go to http://localhost/phpmyadmin in your browser

2. Set a password for root (recommended)

   • Click “User accounts”
   • Find the user “root” with “localhost”
   • Click “Edit privileges”
   • Click “Change password”
   • Set password to: root

3. Update the config file

   Open this file: C:\xampp\phpMyAdmin\config.inc.php

   Change these lines:

1
$cfg['Servers'][$i]['auth_type'] = 'config';
2
$cfg['Servers'][$i]['user'] = 'root';
3
$cfg['Servers'][$i]['password'] = 'root';
4
$cfg['Servers'][$i]['AllowNoPassword'] = false;

4. Restart MySQL
   • Go to XAMPP Control Panel
   • Click “Stop” on MySQL
   • Click “Start” on MySQL

Step 1: Install Apache#

For Ubuntu or Debian:

1
# Update your system
2
sudo apt update
3

4
# Install Apache
5
sudo apt install apache2 -y
6

7
# Start Apache
8
sudo systemctl start apache2
9
sudo systemctl enable apache2
10

11
# Check if it works
12
sudo systemctl status apache2

For CentOS or Fedora:

1
# Install Apache
2
sudo dnf install httpd -y
3

4
# Start Apache
5
sudo systemctl start httpd
6
sudo systemctl enable httpd
7

8
# Open the firewall
9
sudo firewall-cmd --permanent --add-service=http
10
sudo firewall-cmd --reload

Check it works:

1
curl http://localhost

Step 2: Install MySQL#

For Ubuntu or Debian:

1
# Install MySQL
2
sudo apt install mysql-server -y
3

4
# Start MySQL
5
sudo systemctl start mysql
6
sudo systemctl enable mysql
7

8
# Make it secure
9
sudo mysql_secure_installation

For CentOS or Fedora:

1
# Install MySQL
2
sudo dnf install mysql-server -y
3

4
# Start MySQL
5
sudo systemctl start mysqld
6
sudo systemctl enable mysqld
7

8
# Make it secure
9
sudo mysql_secure_installation

Step 3: Set the Root Password#

1
# Open MySQL
2
sudo mysql
3

4
# Set the password
5
ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'root';
6
FLUSH PRIVILEGES;
7
EXIT;
8

9
# Test it
10
mysql -u root -p
11
# Type: root

Step 4: Install PHP#

For Ubuntu or Debian:

1
# Install PHP
2
sudo apt install php libapache2-mod-php php-mysql php-mbstring php-xml php-curl -y
3

4
# Restart Apache
5
sudo systemctl restart apache2
6

7
# Check PHP version
8
php -v

For CentOS or Fedora:

1
# Install extra repository
2
sudo dnf install epel-release -y
3

4
# Install PHP
5
sudo dnf install php php-mysqlnd php-mbstring php-xml -y
6

7
# Restart Apache
8
sudo systemctl restart httpd

Check PHP works:

1
# Create a test file
2
echo "<?php phpinfo(); ?>" | sudo tee /var/www/html/info.php
3

4
# Open in browser: http://localhost/info.php

Step 5: Install phpMyAdmin (Optional)#

For Ubuntu or Debian:

1
# Install phpMyAdmin
2
sudo apt install phpmyadmin -y
3

4
# When asked:
5
# - Choose "apache2"
6
# - Choose "Yes" for dbconfig-common
7
# - Set a password
8

9
# Enable it
10
sudo ln -s /etc/phpmyadmin/apache.conf /etc/apache2/conf-available/phpmyadmin.conf
11
sudo a2enconf phpmyadmin
12
sudo systemctl restart apache2

Open it: http://localhost/phpmyadmin

Step 6: Set Permissions#

1
# Create folder for LABx_Docs
2
sudo mkdir -p /var/www/html/LABx_Docs
3

4
# Set the owner
5
sudo chown -R $USER:www-data /var/www/html/LABx_Docs
6

7
# Set permissions
8
sudo chmod -R 775 /var/www/html/LABx_Docs

Step 1: Install Homebrew#

Homebrew is a tool that makes it easy to install software on Mac.

1
# Install Homebrew
2
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
3

4
# Add it to your path (for Apple Silicon Macs)
5
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> ~/.zprofile
6
eval "$(/opt/homebrew/bin/brew shellenv)"
7

8
# Check it works
9
brew --version

Step 2: Install Apache#

1
# Stop the built-in Apache (if running)
2
sudo apachectl stop
3

4
# Install Apache with Homebrew
5
brew install httpd
6

7
# Start Apache
8
brew services start httpd
9

10
# Check it works
11
curl http://localhost:8080

Note: Homebrew Apache uses port 8080, not 80.

Step 3: Install MySQL#

1
# Install MySQL
2
brew install mysql
3

4
# Start MySQL
5
brew services start mysql
6

7
# Make it secure
8
mysql_secure_installation

Set the root password:

1
mysql -u root
2

3
ALTER USER 'root'@'localhost' IDENTIFIED BY 'root';
4
FLUSH PRIVILEGES;
5
EXIT;

Step 4: Install PHP#

1
# Install PHP
2
brew install php@8.2
3

4
# Add it to your path
5
echo 'export PATH="/opt/homebrew/opt/php@8.2/bin:$PATH"' >> ~/.zshrc
6
source ~/.zshrc
7

8
# Check it works
9
php -v

Connect PHP to Apache:

Open this file: /opt/homebrew/etc/httpd/httpd.conf

Add these lines:

1
LoadModule php_module /opt/homebrew/opt/php@8.2/lib/httpd/modules/libphp.so
2

3
<FilesMatch \.php$>
4
    SetHandler application/x-httpd-php
5
</FilesMatch>

Restart Apache:

1
brew services restart httpd

Easier Option: Use MAMP#

If the steps above are too difficult, you can use MAMP instead:

1. Download MAMP from https://www.mamp.info/
2. Install it
3. Open MAMP and click “Start Servers”
4. phpMyAdmin is at http://localhost:8888/phpMyAdmin

Create the Progress Databases#

LABx_Docs needs these databases to save your progress:

1
-- Access Control progress database
2
CREATE DATABASE IF NOT EXISTS ac_progress;
3
USE ac_progress;
4

5
CREATE TABLE IF NOT EXISTS solved_labs (
6
    lab_number INT PRIMARY KEY,
7
    solved_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
8
    reset_count INT DEFAULT 0
9
);
10

11
-- API Security progress database
12
CREATE DATABASE IF NOT EXISTS api_progress;
13
USE api_progress;
14

15
CREATE TABLE IF NOT EXISTS solved_labs (
16
    lab_number INT PRIMARY KEY,
17
    solved_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
18
    reset_count INT DEFAULT 0
19
);
20

21
-- Authentication progress database
22
CREATE DATABASE IF NOT EXISTS auth_progress;
23
USE auth_progress;
24

25
CREATE TABLE IF NOT EXISTS solved_labs (
26
    lab_number INT PRIMARY KEY,
27
    solved_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
28
    reset_count INT DEFAULT 0
29
);

1
mysql -u root -p
2
# Type password: root
3
# Then paste the SQL above

Check it worked#

1
SHOW DATABASES;

You should see:

1
ac_progress
2
api_progress
3
auth_progress

Step 1: Download the Project#

On Windows:

1
cd C:\xampp\htdocs
2
git clone https://github.com/M9nx/LABx_Docs.git

On Linux:

1
cd /var/www/html
2
sudo git clone https://github.com/M9nx/LABx_Docs.git
3
sudo chown -R $USER:www-data LABx_Docs

On macOS:

1
cd /opt/homebrew/var/www
2
git clone https://github.com/M9nx/LABx_Docs.git

Step 2: Check the Database Settings#

Each lab has a config.php file. The default settings are:

1
<?php
2
$db_host = 'localhost';
3
$db_user = 'root';
4
$db_pass = 'root';
5
?>

If your password is different, change it in these files.

Step 3: Set Up Lab Databases#

Each lab needs its own database. You can set them up one by one:

1
http://localhost/LABx_Docs/AC/Lab-01/setup_db.php

Or set up all labs at once:

1
http://localhost/LABx_Docs/AC/setup-all-databases.php

Step 4: Open the Platform#

Go to:

1
http://localhost/LABx_Docs/

Useful Tools#

Browser DevTools:

• Press F12 to open
• Network tab: see all requests
• Elements tab: see the HTML code
• Console tab: see JavaScript errors

Burp Suite:

• Download free version from portswigger.net
• Set your browser proxy to 127.0.0.1:8080
• You can see and change HTTP requests

Setup Problems#

Q: XAMPP Apache won’t start - “Port 80 in use”

Another program is using port 80. Usually Skype or IIS.

How to fix:

1. Find what is using port 80:

   1
   netstat -aon | findstr :80
   

2. Stop the other program, OR change Apache to use port 8080:

   • Open C:\xampp\apache\conf\httpd.conf
   • Change Listen 80 to Listen 8080
   • Now use http://localhost:8080

Q: MySQL won’t start in XAMPP

Maybe another MySQL is already running.

How to fix:

1. Check if MySQL is running:

   1
   netstat -aon | findstr :3306
   

2. If yes, stop the other MySQL in Windows Services

Q: “Access denied for user ‘root’@‘localhost’”

The password is wrong.

How to fix:

1. Open XAMPP Shell
2. Type:

   1
   mysqladmin -u root password 'root'
   

Or try empty password in config.php:

1
$db_pass = '';

Q: phpMyAdmin shows connection error

The password in config file is wrong.

How to fix: Open C:\xampp\phpMyAdmin\config.inc.php and set:

1
$cfg['Servers'][$i]['password'] = 'root';

Lab Problems#

Q: Lab says “Database connection failed”

The lab database doesn’t exist.

How to fix:

1. Run the setup:

   1
   http://localhost/LABx_Docs/AC/Lab-XX/setup_db.php
   

2. Check your password in config.php

Q: My progress is not saving

The progress database doesn’t exist.

How to fix:

1. Create the databases (see Database Setup section above)
2. Check the tables exist:

   1
   USE ac_progress;
   2
   SHOW TABLES;
   

Q: How do I reset a lab?

You can reset any lab to try again:

1. Click “Reset Lab” button on the lab page, OR

2. Go to:

   1
   http://localhost/LABx_Docs/AC/Lab-XX/setup_db.php?reset=true
   

About the Labs#

Q: What is IDOR?

IDOR means “Insecure Direct Object Reference”. It happens when a website shows you data using an ID in the URL, and you can change that ID to see other people’s data.

Example:

1
/profile.php?id=1    <- Your data
2
/profile.php?id=2    <- Someone else's data (IDOR!)

This is a big security problem because attackers can see or change data they should not access.

Q: What tools do I need?

Basic tools (free):

• Browser DevTools (press F12)
• Burp Suite Community Edition

Helpful tools (free):

• curl (command line)
• Postman (API testing)

Q: What order should I do the labs?

We recommend:

1. Start with Apprentice labs (green) - Easy, basic concepts
2. Then do Practitioner labs (orange) - Medium difficulty
3. Finally Expert labs (red) - Hard, advanced techniques

In each category, the labs are numbered in a good order.

Q: Can I see the answers?

Each lab has:

• Hints to help you
• Documentation explaining the vulnerability
• Clear goal to complete

For full solutions:

• Check the docs.php page for each lab
• Ask in GitHub Discussions
• Some labs show the solution after many tries

Try to solve it yourself first - you learn more that way!

Quick Checks#

Windows:

1
:: Is Apache running?
2
netstat -aon | findstr :80
3

4
:: Is MySQL running?
5
netstat -aon | findstr :3306
6

7
:: Is PHP working?
8
php -v
9

10
:: Can you connect to MySQL?
11
mysql -u root -proot -e "SELECT 1;"

Linux/macOS:

1
# Check services
2
sudo systemctl status apache2
3
sudo systemctl status mysql
4

5
# Check PHP
6
php -v
7

8
# Check MySQL connection
9
mysql -u root -proot -e "SELECT 1;"

Common Errors#

Start Fresh#

If nothing works, you can reset everything:

1. Delete all lab databases:

1
DROP DATABASE IF EXISTS ac_progress;
2
DROP DATABASE IF EXISTS api_progress;
3
DROP DATABASE IF EXISTS auth_progress;

2. Delete and download again:

1
rm -rf LABx_Docs
2
git clone https://github.com/M9nx/LABx_Docs.git

3. Run setup again:

1
http://localhost/LABx_Docs/AC/setup-all-databases.php

Ask the Community#

Have a question? Want to share your solution?

GitHub Discussions: github.com/M9nx/LABx_Docs/discussions

• Ask questions about labs
• Share tips
• Talk about security topics
• Show your progress

Report a Bug#

Found a problem? Something not working?

GitHub Issues: github.com/M9nx/LABx_Docs/issues

Please include:

• Your operating system
• PHP version
• What you did
• What error you saw
• Which lab has the problem

Contact#

For other questions:

X (Twitter): @__m9nx

Learn More#

• PortSwigger Web Security Academy - Where this project got ideas from
• OWASP Top 10 - List of common web security problems
• HackerOne Hacktivity - Real bug reports from security researchers

Made for the security community

Home | Repository | Twitter

Last updated: January 2026