Brown Badge

27 Completed
37 Videos
26 Exercises

PentesterLab's Brown badge focuses on exploiting various web application vulnerabilities, including JWE, signing oracles, PHP unserialize, Spring Actuators, Prototype Pollution, SQL injection, Unicode, malicious Zip files, and remote command execution in multiple frameworks and platforms.

Exercises

Easy
Signing Oracle
  • This exercise covers how a signing oracle can be used to bypass authorization in place
  • 2 videos
  • Completed by 812 students
  • Takes < 1 Hr. on average

 

Easy
JS Prototype Pollution
  • This exercise covers how to exploit Prototype Pollution against a JavaScript application
  • 1 video
  • Completed by 890 students
  • Takes < 1 Hr. on average

 

Easy
CVE-2021-41773
  • This challenge covers how to read arbitrary files by leveraging CVE-2021-41773
  • 1 video
  • Completed by 528 students
  • Takes < 1 Hr. on average
  • Apache
  • CWE-23

 

Medium
JSON Web Encryption
  • This exercise covers how you can create your own JWE if you have access to the public key used by the server
  • 2 videos
  • Completed by 519 students
  • Takes < 1 Hr. on average

 

Medium
GCM Nonce Reuse
  • This challenge covers the impact of nonce reuse on GCM
  • 2 videos
  • Completed by 162 students
  • Takes 1-2 Hrs. on average
  • Ruby

 

Medium
Apache Pluto RCE
  • This exercise covers how to gain code execution on Apache Pluto 3.0.0 due to a flaw in the authorization logic
  • 1 video
  • Completed by 528 students
  • Takes < 1 Hr. on average
  • CWE-200

 

Medium
CVE-2021-40438
  • This challenge covers how to trigger a Server-Side Request Forgery by leveraging CVE-2021-40438
  • 1 video
  • Completed by 322 students
  • Takes < 1 Hr. on average
  • Apache
  • CWE-918

 

Medium
Unicode and Uppercase
  • This exercise covers how you can use unicode to gain access to an admin account.
  • 2 videos
  • Completed by 648 students
  • Takes < 1 Hr. on average

 

Medium
Unicode and Downcase
  • This exercise covers how you can use unicode to gain access to an admin account.
  • 2 videos
  • Completed by 579 students
  • Takes < 1 Hr. on average

 

Medium
Zip symlink
  • This exercise covers how you can create a malicious Zip file and use it to gain access to sensitive files.
  • 1 video
  • Completed by 563 students
  • Takes < 1 Hr. on average

 

Medium
Express Local File Read
  • This exercise covers how an insecure call to render can be used to gain local files read with Express
  • 1 video
  • Completed by 388 students
  • Takes < 1 Hr. on average

 

Medium
CVE-2020-14343: PyYAML unsafe loader
  • This exercise covers how you can gain code execution when an application use a vulnerable version of PyYAML and relies on load()
  • 1 video
  • Completed by 303 students
  • Takes < 1 Hr. on average
  • CWE-20

 

Medium
CVE-2022-21449
  • This exercise covers the exploitation of CVE-2022-21449 against a Java Application relying on JWT
  • 4 videos
  • Completed by 156 students
  • Takes < 1 Hr. on average
  • Java
  • jwt

 

Medium
CVE-2021-41773 II
  • This challenge covers how to gain code execution by leveraging CVE-2021-41773
  • 1 video
  • Completed by 194 students
  • Takes 1-2 Hrs. on average
  • Apache

 

Medium
CVE-2020-7115: Aruba Clearpass RCE
  • This exercise covers a remote command execution issue on Aruba Clearpass RCE
  • 1 video
  • Completed by 210 students
  • Takes < 1 Hr. on average
  • CWE-306

 

Medium
CGI and Signature
  • This exercise covers the exploitation of a vulnerable CGI.
  • 2 videos
  • Completed by 220 students
  • Takes < 1 Hr. on average

 

Medium
EDDSA vulnerability in Monocypher
  • This exercise covers the exploitation of a vulnerability impacting Monocypher.
  • 1 video
  • Completed by 175 students
  • Takes 1-2 Hrs. on average
  • Crypto

 

Medium
Unicode and NFKC
  • This exercise covers how to leverage unicode to exploit a directory traversal
  • 1 video
  • Completed by 299 students
  • Takes < 1 Hr. on average

 

Medium
From SQL injection to Shell III: PostgreSQL Edition
  • This exercise covers how to gain access to an administration interface using a SQL injection, and how to get command execution using Ghostscript
  • 2 videos
  • Completed by 243 students
  • Takes 2-4 Hrs. on average
  • Ruby-on-Rails
  • SQL Injection
  • CWE-89

 

Medium
Spring Actuators
  • This exercise covers how you can gain code execution using Spring Actuators when Spring Cloud is used.
  • 1 video
  • Completed by 282 students
  • Takes 1-2 Hrs. on average

 

Medium
PHP phar://
  • This exercise covers how the PHP phar:// handler can be used to gain code execution using PHP unserialize.
  • 1 video
  • Completed by 342 students
  • Takes < 1 Hr. on average

 

Hard
RCE via argument injection
  • This exercise covers a remote command execution vulnerability via argument injection
  • Completed by 51 students
  • Takes 2-4 Hrs. on average

 

Hard
Ox Remote Code Execution
  • This exercise covers how you can gain code execution when an application is using Ox to deserialize data and is running on Ruby 2.3
  • 1 video
  • Completed by 78 students
  • Takes 2-4 Hrs. on average
  • Ruby

 

Hard
JWT Algorithm Confusion with RSA Public Key Recovery
  • This exercise covers the exploitation of algorithm confusion when no public key is available
  • 3 videos
  • Completed by 184 students
  • Takes < 1 Hr. on average
  • PHP
  • jwt
  • cwe-310

 

Hard
CVE-2020-8163: Rails local name RCE
  • This exercise details the exploitation of CVE-2020-8163 to gain code execution
  • 2 videos
  • Completed by 217 students
  • Takes 1-2 Hrs. on average
  • CWE-94

 

Hard
Ox Remote Code Execution II
  • This exercise covers how you can gain code execution when an application is using Ox to deserialize data and is running on Ruby 2.7
  • Completed by 32 students
  • Takes 2-4 Hrs. on average
  • Ruby