Brown Badge

21 Completed
37 Videos
26 Exercises

PentesterLab's Brown badge focuses on exploiting various web application vulnerabilities, including JWE, signing oracles, PHP unserialize, Spring Actuators, Prototype Pollution, SQL injection, Unicode, malicious Zip files, and remote command execution in multiple frameworks and platforms.

Exercises

Easy
Signing Oracle
  • This exercise covers how a signing oracle can be used to bypass authorization in place
  • 2 videos
  • Completed by 743 students
  • Takes < 1 Hr. on average

 

Easy
JS Prototype Pollution
  • This exercise covers how to exploit Prototype Pollution against a JavaScript application
  • 1 video
  • Completed by 817 students
  • Takes < 1 Hr. on average

 

Easy
CVE-2021-41773
  • This challenge covers how to read arbitrary files by leveraging CVE-2021-41773
  • 1 video
  • Completed by 461 students
  • Takes < 1 Hr. on average
  • Apache
  • CWE-23

 

Medium
JSON Web Encryption
  • This exercise covers how you can create your own JWE if you have access to the public key used by the server
  • 2 videos
  • Completed by 479 students
  • Takes < 1 Hr. on average

 

Medium
GCM Nonce Reuse
  • This challenge covers the impact of nonce reuse on GCM
  • 2 videos
  • Completed by 127 students
  • Takes < 1 Hr. on average
  • Ruby

 

Medium
Apache Pluto RCE
  • This exercise covers how to gain code execution on Apache Pluto 3.0.0 due to a flaw in the authorization logic
  • 1 video
  • Completed by 488 students
  • Takes < 1 Hr. on average
  • CWE-200

 

Medium
CVE-2021-40438
  • This challenge covers how to trigger a Server-Side Request Forgery by leveraging CVE-2021-40438
  • 1 video
  • Completed by 283 students
  • Takes < 1 Hr. on average
  • Apache
  • CWE-918

 

Medium
Unicode and Uppercase
  • This exercise covers how you can use unicode to gain access to an admin account.
  • 2 videos
  • Completed by 606 students
  • Takes < 1 Hr. on average

 

Medium
Unicode and Downcase
  • This exercise covers how you can use unicode to gain access to an admin account.
  • 2 videos
  • Completed by 543 students
  • Takes < 1 Hr. on average

 

Medium
Zip symlink
  • This exercise covers how you can create a malicious Zip file and use it to gain access to sensitive files.
  • 1 video
  • Completed by 529 students
  • Takes < 1 Hr. on average

 

Medium
Express Local File Read
  • This exercise covers how an insecure call to render can be used to gain local files read with Express
  • 1 video
  • Completed by 342 students
  • Takes < 1 Hr. on average

 

Medium
CVE-2020-14343: PyYAML unsafe loader
  • This exercise covers how you can gain code execution when an application use a vulnerable version of PyYAML and relies on load()
  • 1 video
  • Completed by 273 students
  • Takes < 1 Hr. on average
  • CWE-20

 

Medium
CVE-2022-21449
  • This exercise covers the exploitation of CVE-2022-21449 against a Java Application relying on JWT
  • 4 videos
  • Completed by 120 students
  • Takes < 1 Hr. on average
  • Java
  • jwt

 

Medium
CVE-2021-41773 II
  • This challenge covers how to gain code execution by leveraging CVE-2021-41773
  • 1 video
  • Completed by 159 students
  • Takes 1-2 Hrs. on average
  • Apache

 

Medium
CVE-2020-7115: Aruba Clearpass RCE
  • This exercise covers a remote command execution issue on Aruba Clearpass RCE
  • 1 video
  • Completed by 179 students
  • Takes < 1 Hr. on average
  • CWE-306

 

Medium
CGI and Signature
  • This exercise covers the exploitation of a vulnerable CGI.
  • 2 videos
  • Completed by 189 students
  • Takes < 1 Hr. on average

 

Medium
EDDSA vulnerability in Monocypher
  • This exercise covers the exploitation of a vulnerability impacting Monocypher.
  • 1 video
  • Completed by 145 students
  • Takes 1-2 Hrs. on average
  • crypto

 

Medium
Unicode and NFKC
  • This exercise covers how to leverage unicode to exploit a directory traversal
  • 1 video
  • Completed by 266 students
  • Takes < 1 Hr. on average

 

Medium
From SQL injection to Shell III: PostgreSQL Edition
  • This exercise covers how to gain access to an administration interface using a SQL injection, and how to get command execution using Ghostscript
  • 2 videos
  • Completed by 201 students
  • Takes 2-4 Hrs. on average
  • Ruby-on-Rails
  • SQL Injection
  • CWE-89

 

Medium
Spring Actuators
  • This exercise covers how you can gain code execution using Spring Actuators when Spring Cloud is used.
  • 1 video
  • Completed by 260 students
  • Takes 1-2 Hrs. on average

 

Medium
PHP phar://
  • This exercise covers how the PHP phar:// handler can be used to gain code execution using PHP unserialize.
  • 1 video
  • Completed by 318 students
  • Takes < 1 Hr. on average

 

Hard
RCE via argument injection
  • This exercise covers a remote command execution vulnerability via argument injection
  • Completed by 41 students
  • Takes > 4 Hrs. on average

 

Hard
Ox Remote Code Execution
  • This exercise covers how you can gain code execution when an application is using Ox to deserialize data and is running on Ruby 2.3
  • 1 video
  • Completed by 62 students
  • Takes 2-4 Hrs. on average
  • Ruby

 

Hard
JSON Web Token XIII
  • This exercise covers the exploitation of algorithm confusion when no public key is available
  • 3 videos
  • Completed by 151 students
  • Takes < 1 Hr. on average
  • PHP
  • jwt
  • cwe-310

 

Hard
CVE-2020-8163: Rails local name RCE
  • This exercise details the exploitation of CVE-2020-8163 to gain code execution
  • 2 videos
  • Completed by 202 students
  • Takes 1-2 Hrs. on average
  • CWE-94

 

Hard
Ox Remote Code Execution II
  • This exercise covers how you can gain code execution when an application is using Ox to deserialize data and is running on Ruby 2.7
  • Completed by 25 students
  • Takes 2-4 Hrs. on average
  • Ruby