Train on real attack chains.
Measure what actually breaks.

The neutral benchmark for API scanners, DAST, and autonomous agents — ground truth, decoys for precision, and blind evaluation rules vendors can trust.

Try ProofRange free Benchmark your scanner

⚠ Labs include real RCE and SSRF. Use only against VulnGym hosts you are authorized to test.

43planted vulns · 3 rings
23+10+10Proof · Agent · Mesh
6+decoys per ring (FP test)
v1.5truth version (ProofRange)

Rings

ProofRange

Ring 1 · proofrange.vulngym.com

SaaS financial API: stateful IDOR, blind SSRF, JWT, prototype pollution → RCE, cache poisoning, business-logic races.

Open lab →

AgentRange

Ring 2 · agentrange.vulngym.com

GraphQL, MCP http_fetch SSRF, scope HPP, mutation chains — built for agentic scanners.

Open lab →

MeshRange

Ring 3 · meshrange.vulngym.com

gRPC metadata trust, WebSocket IDOR, OAuth replay, internal worker SSRF, multi-tenant overrides.

Open lab →

For scanner vendors

Export findings from your product, score against our oracle, attach a Vendor Score Report to your RFI or release notes.

View pricing How scoring works

Manual pentest

No scanner required — Burp, curl, and PENTEST.md.

Open ProofRange