Brown Badge

21 Completed
37 Videos
26 Exercises

PentesterLab's Brown badge focuses on exploiting various web application vulnerabilities, including JWE, signing oracles, PHP unserialize, Spring Actuators, Prototype Pollution, SQL injection, Unicode, malicious Zip files, and remote command execution in multiple frameworks and platforms.

Exercises

Easy
Signing Oracle
  • This exercise covers how a signing oracle can be used to bypass authorization in place
  • 2 videos
  • Completed by 749 students
  • Takes < 1 Hr. on average

 

Easy
JS Prototype Pollution
  • This exercise covers how to exploit Prototype Pollution against a JavaScript application
  • 1 video
  • Completed by 824 students
  • Takes < 1 Hr. on average

 

Easy
CVE-2021-41773
  • This challenge covers how to read arbitrary files by leveraging CVE-2021-41773
  • 1 video
  • Completed by 470 students
  • Takes < 1 Hr. on average
  • Apache
  • CWE-23

 

Medium
JSON Web Encryption
  • This exercise covers how you can create your own JWE if you have access to the public key used by the server
  • 2 videos
  • Completed by 482 students
  • Takes < 1 Hr. on average

 

Medium
GCM Nonce Reuse
  • This challenge covers the impact of nonce reuse on GCM
  • 2 videos
  • Completed by 131 students
  • Takes < 1 Hr. on average
  • Ruby

 

Medium
Apache Pluto RCE
  • This exercise covers how to gain code execution on Apache Pluto 3.0.0 due to a flaw in the authorization logic
  • 1 video
  • Completed by 492 students
  • Takes < 1 Hr. on average
  • CWE-200

 

Medium
CVE-2021-40438
  • This challenge covers how to trigger a Server-Side Request Forgery by leveraging CVE-2021-40438
  • 1 video
  • Completed by 289 students
  • Takes < 1 Hr. on average
  • Apache
  • CWE-918

 

Medium
Unicode and Uppercase
  • This exercise covers how you can use unicode to gain access to an admin account.
  • 2 videos
  • Completed by 612 students
  • Takes < 1 Hr. on average

 

Medium
Unicode and Downcase
  • This exercise covers how you can use unicode to gain access to an admin account.
  • 2 videos
  • Completed by 549 students
  • Takes < 1 Hr. on average

 

Medium
Zip symlink
  • This exercise covers how you can create a malicious Zip file and use it to gain access to sensitive files.
  • 1 video
  • Completed by 533 students
  • Takes < 1 Hr. on average

 

Medium
Express Local File Read
  • This exercise covers how an insecure call to render can be used to gain local files read with Express
  • 1 video
  • Completed by 348 students
  • Takes < 1 Hr. on average

 

Medium
CVE-2020-14343: PyYAML unsafe loader
  • This exercise covers how you can gain code execution when an application use a vulnerable version of PyYAML and relies on load()
  • 1 video
  • Completed by 276 students
  • Takes < 1 Hr. on average
  • CWE-20

 

Medium
CVE-2022-21449
  • This exercise covers the exploitation of CVE-2022-21449 against a Java Application relying on JWT
  • 4 videos
  • Completed by 123 students
  • Takes < 1 Hr. on average
  • Java
  • jwt

 

Medium
CVE-2021-41773 II
  • This challenge covers how to gain code execution by leveraging CVE-2021-41773
  • 1 video
  • Completed by 163 students
  • Takes 1-2 Hrs. on average
  • Apache

 

Medium
CVE-2020-7115: Aruba Clearpass RCE
  • This exercise covers a remote command execution issue on Aruba Clearpass RCE
  • 1 video
  • Completed by 182 students
  • Takes < 1 Hr. on average
  • CWE-306

 

Medium
CGI and Signature
  • This exercise covers the exploitation of a vulnerable CGI.
  • 2 videos
  • Completed by 191 students
  • Takes < 1 Hr. on average

 

Medium
EDDSA vulnerability in Monocypher
  • This exercise covers the exploitation of a vulnerability impacting Monocypher.
  • 1 video
  • Completed by 147 students
  • Takes 1-2 Hrs. on average
  • crypto

 

Medium
Unicode and NFKC
  • This exercise covers how to leverage unicode to exploit a directory traversal
  • 1 video
  • Completed by 269 students
  • Takes < 1 Hr. on average

 

Medium
From SQL injection to Shell III: PostgreSQL Edition
  • This exercise covers how to gain access to an administration interface using a SQL injection, and how to get command execution using Ghostscript
  • 2 videos
  • Completed by 206 students
  • Takes 2-4 Hrs. on average
  • Ruby-on-Rails
  • SQL Injection
  • CWE-89

 

Medium
Spring Actuators
  • This exercise covers how you can gain code execution using Spring Actuators when Spring Cloud is used.
  • 1 video
  • Completed by 262 students
  • Takes 1-2 Hrs. on average

 

Medium
PHP phar://
  • This exercise covers how the PHP phar:// handler can be used to gain code execution using PHP unserialize.
  • 1 video
  • Completed by 320 students
  • Takes < 1 Hr. on average

 

Hard
RCE via argument injection
  • This exercise covers a remote command execution vulnerability via argument injection
  • Completed by 41 students
  • Takes > 4 Hrs. on average

 

Hard
Ox Remote Code Execution
  • This exercise covers how you can gain code execution when an application is using Ox to deserialize data and is running on Ruby 2.3
  • 1 video
  • Completed by 64 students
  • Takes 2-4 Hrs. on average
  • Ruby

 

Hard
JSON Web Token XIII
  • This exercise covers the exploitation of algorithm confusion when no public key is available
  • 3 videos
  • Completed by 153 students
  • Takes < 1 Hr. on average
  • PHP
  • jwt
  • cwe-310

 

Hard
CVE-2020-8163: Rails local name RCE
  • This exercise details the exploitation of CVE-2020-8163 to gain code execution
  • 2 videos
  • Completed by 204 students
  • Takes 1-2 Hrs. on average
  • CWE-94

 

Hard
Ox Remote Code Execution II
  • This exercise covers how you can gain code execution when an application is using Ox to deserialize data and is running on Ruby 2.7
  • Completed by 25 students
  • Takes 2-4 Hrs. on average
  • Ruby