Brown Badge

26 Completed
37 Videos
26 Exercises

PentesterLab's Brown badge focuses on exploiting various web application vulnerabilities, including JWE, signing oracles, PHP unserialize, Spring Actuators, Prototype Pollution, SQL injection, Unicode, malicious Zip files, and remote command execution in multiple frameworks and platforms.

Exercises

Easy
Signing Oracle
  • This exercise covers how a signing oracle can be used to bypass authorization in place
  • 2 videos
  • Completed by 788 students
  • Takes < 1 Hr. on average

 

Easy
JS Prototype Pollution
  • This exercise covers how to exploit Prototype Pollution against a JavaScript application
  • 1 video
  • Completed by 865 students
  • Takes < 1 Hr. on average

 

Easy
CVE-2021-41773
  • This challenge covers how to read arbitrary files by leveraging CVE-2021-41773
  • 1 video
  • Completed by 509 students
  • Takes < 1 Hr. on average
  • Apache
  • CWE-23

 

Medium
JSON Web Encryption
  • This exercise covers how you can create your own JWE if you have access to the public key used by the server
  • 2 videos
  • Completed by 506 students
  • Takes < 1 Hr. on average

 

Medium
GCM Nonce Reuse
  • This challenge covers the impact of nonce reuse on GCM
  • 2 videos
  • Completed by 153 students
  • Takes 1-2 Hrs. on average
  • Ruby

 

Medium
Apache Pluto RCE
  • This exercise covers how to gain code execution on Apache Pluto 3.0.0 due to a flaw in the authorization logic
  • 1 video
  • Completed by 519 students
  • Takes < 1 Hr. on average
  • CWE-200

 

Medium
CVE-2021-40438
  • This challenge covers how to trigger a Server-Side Request Forgery by leveraging CVE-2021-40438
  • 1 video
  • Completed by 311 students
  • Takes < 1 Hr. on average
  • Apache
  • CWE-918

 

Medium
Unicode and Uppercase
  • This exercise covers how you can use unicode to gain access to an admin account.
  • 2 videos
  • Completed by 637 students
  • Takes < 1 Hr. on average

 

Medium
Unicode and Downcase
  • This exercise covers how you can use unicode to gain access to an admin account.
  • 2 videos
  • Completed by 569 students
  • Takes < 1 Hr. on average

 

Medium
Zip symlink
  • This exercise covers how you can create a malicious Zip file and use it to gain access to sensitive files.
  • 1 video
  • Completed by 553 students
  • Takes < 1 Hr. on average

 

Medium
Express Local File Read
  • This exercise covers how an insecure call to render can be used to gain local files read with Express
  • 1 video
  • Completed by 375 students
  • Takes < 1 Hr. on average

 

Medium
CVE-2020-14343: PyYAML unsafe loader
  • This exercise covers how you can gain code execution when an application use a vulnerable version of PyYAML and relies on load()
  • 1 video
  • Completed by 294 students
  • Takes < 1 Hr. on average
  • CWE-20

 

Medium
CVE-2022-21449
  • This exercise covers the exploitation of CVE-2022-21449 against a Java Application relying on JWT
  • 4 videos
  • Completed by 144 students
  • Takes < 1 Hr. on average
  • Java
  • jwt

 

Medium
CVE-2021-41773 II
  • This challenge covers how to gain code execution by leveraging CVE-2021-41773
  • 1 video
  • Completed by 185 students
  • Takes 1-2 Hrs. on average
  • Apache

 

Medium
CVE-2020-7115: Aruba Clearpass RCE
  • This exercise covers a remote command execution issue on Aruba Clearpass RCE
  • 1 video
  • Completed by 200 students
  • Takes < 1 Hr. on average
  • CWE-306

 

Medium
CGI and Signature
  • This exercise covers the exploitation of a vulnerable CGI.
  • 2 videos
  • Completed by 212 students
  • Takes < 1 Hr. on average

 

Medium
EDDSA vulnerability in Monocypher
  • This exercise covers the exploitation of a vulnerability impacting Monocypher.
  • 1 video
  • Completed by 167 students
  • Takes 1-2 Hrs. on average
  • Crypto

 

Medium
Unicode and NFKC
  • This exercise covers how to leverage unicode to exploit a directory traversal
  • 1 video
  • Completed by 290 students
  • Takes < 1 Hr. on average

 

Medium
From SQL injection to Shell III: PostgreSQL Edition
  • This exercise covers how to gain access to an administration interface using a SQL injection, and how to get command execution using Ghostscript
  • 2 videos
  • Completed by 235 students
  • Takes 2-4 Hrs. on average
  • Ruby-on-Rails
  • SQL Injection
  • CWE-89

 

Medium
Spring Actuators
  • This exercise covers how you can gain code execution using Spring Actuators when Spring Cloud is used.
  • 1 video
  • Completed by 275 students
  • Takes 1-2 Hrs. on average

 

Medium
PHP phar://
  • This exercise covers how the PHP phar:// handler can be used to gain code execution using PHP unserialize.
  • 1 video
  • Completed by 335 students
  • Takes < 1 Hr. on average

 

Hard
RCE via argument injection
  • This exercise covers a remote command execution vulnerability via argument injection
  • Completed by 49 students
  • Takes 2-4 Hrs. on average

 

Hard
Ox Remote Code Execution
  • This exercise covers how you can gain code execution when an application is using Ox to deserialize data and is running on Ruby 2.3
  • 1 video
  • Completed by 74 students
  • Takes 2-4 Hrs. on average
  • Ruby

 

Hard
JWT Algorithm Confusion with RSA Public Key Recovery
  • This exercise covers the exploitation of algorithm confusion when no public key is available
  • 3 videos
  • Completed by 168 students
  • Takes < 1 Hr. on average
  • PHP
  • jwt
  • cwe-310

 

Hard
CVE-2020-8163: Rails local name RCE
  • This exercise details the exploitation of CVE-2020-8163 to gain code execution
  • 2 videos
  • Completed by 212 students
  • Takes 1-2 Hrs. on average
  • CWE-94

 

Hard
Ox Remote Code Execution II
  • This exercise covers how you can gain code execution when an application is using Ox to deserialize data and is running on Ruby 2.7
  • Completed by 31 students
  • Takes 2-4 Hrs. on average
  • Ruby