Brown Badge

PentesterLab's Brown badge focuses on exploiting various web application vulnerabilities, including JWE, signing oracles, PHP unserialize, Spring Actuators, Prototype Pollution, SQL injection, Unicode, malicious Zip files, and remote command execution in multiple frameworks and platforms.

27 exercises 34 completed 37 videos

Exercises

This exercise covers how a signing oracle can be used to bypass authorization in place
2 videos
Completed by 858 students
Takes < 1 Hr. on average

JS Prototype Pollution

This exercise covers how to exploit Prototype Pollution against a JavaScript application
1 video
Completed by 977 students
Takes < 1 Hr. on average

This challenge covers how to read arbitrary files by leveraging CVE-2021-41773
1 video
Completed by 575 students
Takes < 1 Hr. on average
Apache
CWE-23

JSON Web Encryption

This exercise covers how you can create your own JWE if you have access to the public key used by the server
2 videos
Completed by 553 students
Takes < 1 Hr. on average

GCM Nonce Reuse

This challenge covers the impact of nonce reuse on GCM
2 videos
Completed by 189 students
Takes < 1 Hr. on average
Ruby

Apache Pluto RCE

This exercise covers how to gain code execution on Apache Pluto 3.0.0 due to a flaw in the authorization logic
1 video
Completed by 562 students
Takes < 1 Hr. on average
CWE-200

This challenge covers how to trigger a Server-Side Request Forgery by leveraging CVE-2021-40438
1 video
Completed by 355 students
Takes < 1 Hr. on average
Apache
CWE-918

Unicode and Uppercase

This exercise covers how you can use unicode to gain access to an admin account.
2 videos
Completed by 689 students
Takes < 1 Hr. on average

Unicode and Downcase

This exercise covers how you can use unicode to gain access to an admin account.
2 videos
Completed by 612 students
Takes < 1 Hr. on average

This exercise covers how you can create a malicious Zip file and use it to gain access to sensitive files.
1 video
Completed by 606 students
Takes < 1 Hr. on average

Express Local File Read

This exercise covers how an insecure call to render can be used to gain local files read with Express
1 video
Completed by 446 students
Takes < 1 Hr. on average

CVE-2020-14343: PyYAML unsafe loader

This exercise covers how you can gain code execution when an application use a vulnerable version of PyYAML and relies on load()
1 video
Completed by 353 students
Takes < 1 Hr. on average
CWE-20

This exercise covers the exploitation of CVE-2022-21449 against a Java Application relying on JWT
4 videos
Completed by 186 students
Takes < 1 Hr. on average
Java
JWT

Coming soon

Medium

PENTESTERLAB

wp2shell: CVE-2026-63030 & CVE-2026-60137

This challenge covers gaining a shell on WordPress by chaining CVE-2026-63030 and CVE-2026-60137.
Takes -- on average
PHP
CVE-2026-63030, CVE-2026-60137, WordPress, Remote Code Execution

CVE-2021-41773 II

This challenge covers how to gain code execution by leveraging CVE-2021-41773
1 video
Completed by 219 students
Takes 1-2 Hrs. on average
Apache

CVE-2020-7115: Aruba Clearpass RCE

This exercise covers a remote command execution issue on Aruba Clearpass RCE
1 video
Completed by 226 students
Takes < 1 Hr. on average
CWE-306

CGI and Signature

This exercise covers the exploitation of a vulnerable CGI.
2 videos
Completed by 237 students
Takes < 1 Hr. on average

EDDSA vulnerability in Monocypher

This exercise covers the exploitation of a vulnerability impacting Monocypher.
1 video
Completed by 192 students
Takes < 1 Hr. on average
Crypto

Unicode and NFKC

This exercise covers how to leverage unicode to exploit a directory traversal
1 video
Completed by 329 students
Takes < 1 Hr. on average

From SQL injection to Shell III: PostgreSQL Edition

This exercise covers how to gain access to an administration interface using a SQL injection, and how to get command execution using Ghostscript
2 videos
Completed by 260 students
Takes 2-4 Hrs. on average
Ruby-on-Rails
SQL Injection
CWE-89

Spring Actuators

This exercise covers how you can gain code execution using Spring Actuators when Spring Cloud is used.
1 video
Completed by 301 students
Takes 1-2 Hrs. on average

This exercise covers how the PHP phar:// handler can be used to gain code execution using PHP unserialize.
1 video
Completed by 365 students
Takes < 1 Hr. on average

RCE via argument injection

This exercise covers a remote command execution vulnerability via argument injection
Completed by 62 students
Takes 2-4 Hrs. on average

Ox Remote Code Execution

This exercise covers how you can gain code execution when an application is using Ox to deserialize data and is running on Ruby 2.3
1 video
Completed by 92 students
Takes 2-4 Hrs. on average
Ruby

JWT Algorithm Confusion with RSA Public Key Recovery

This exercise covers the exploitation of algorithm confusion when no public key is available
3 videos
Completed by 227 students
Takes < 1 Hr. on average
PHP
JWT
cwe-310

CVE-2020-8163: Rails local name RCE

This exercise details the exploitation of CVE-2020-8163 to gain code execution
2 videos
Completed by 231 students
Takes 1-2 Hrs. on average
CWE-94

Ox Remote Code Execution II

This exercise covers how you can gain code execution when an application is using Ox to deserialize data and is running on Ruby 2.7
Completed by 42 students
Takes 2-4 Hrs. on average
Ruby