Other kids know facts that you don't because people care about different things.
56 karma · joined November 28, 2010
They have a couple of fake websites that have a bunch of vulnerabilities of varying difficulty and you get points for exploiting them.
I am not affiliated with them, but saw a demo once and thought it was cool.
With regards to what the arrows indicate, I've done dotted line arrows are synchronous, with a solid arrowhead meaning request body and an outlined arrowhead being the response. Then used solid black line with a single solid arrowhead for an asynchronous request.
Because 3a doesn't make sense, 4a doesn't make sense.