Media Badge

22 Videos
18 Exercises

The media badge is our set of exercises created to teach you how to abuse applications that allows you to upload or retrieve files in different formats: PDF, Images, Videos and use this behaviour to gain code execution or arbitrary file read

Exercises

Easy
SSRF in PDF generation
  • This exercise covers how you can read arbitrary files when an application generates pdfs from provided links
  • 1 video
  • Completed by 812 students
  • Takes < 1 Hr. on average

 

Coming soon
Easy
ODF XXE
  • This exercise covers the exploitation of an XXE in an ODF Parser
  • Takes -- on average

 

Medium
CVE-2022-39224
  • This exercise covers the exploitation of CVE-2022-39224
  • 1 video
  • Completed by 71 students
  • Takes 2-4 Hrs. on average
  • Ruby
  • CWE-78

 

Medium
XSL PHP
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 234 students
  • Takes < 1 Hr. on average
  • PHP
  • CWE-94,CWE-306

 

Medium
XSL PHP II
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 203 students
  • Takes < 1 Hr. on average
  • PHP
  • CWE-94

 

Medium
DOMPDF RCE
  • This exercise covers the exploitation of a vulnerability in the DOMPDF library
  • 2 videos
  • Completed by 123 students
  • Takes < 1 Hr. on average
  • PHP

 

Medium
XSL PHP IV
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 122 students
  • Takes 2-4 Hrs. on average
  • PHP
  • CWE-94

 

Medium
DOMPDF RCE III
  • This exercise covers the exploitation of a vulnerability in the DOMPDF library
  • 2 videos
  • Completed by 39 students
  • Takes 2-4 Hrs. on average
  • PHP

 

Medium
XSL Java
  • This exercise covers the exploitation of a Java application using XSL
  • 2 videos
  • Completed by 93 students
  • Takes < 1 Hr. on average
  • Java

 

Medium
DOMPDF RCE II
  • This exercise covers the exploitation of a vulnerability in the DOMPDF library
  • 3 videos
  • Completed by 56 students
  • Takes 2-4 Hrs. on average
  • PHP

 

Medium
XSL PHP III
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 146 students
  • Takes < 1 Hr. on average
  • PHP
  • CWE-94

 

Medium
CVE-2021-33564 Argument Injection in Ruby Dragonfly
  • This exercise covers how you can get arbitrary file read using CVE-2021-33564 against Refinery CMS
  • Completed by 118 students
  • Takes < 1 Hr. on average
  • CWE-88

 

Medium
CVE-2021-22204: Exiftool RCE II
  • This exercise covers how you can gain code execution when an application uses exiftool on user-controlled files
  • Completed by 64 students
  • Takes < 1 Hr. on average
  • CWE-94,CWE-74

 

Medium
SSRF via FFMPEG
  • This exercise covers how you can read arbitrary files when an application uses ffmpeg to render videos from a video you provide
  • Completed by 221 students
  • Takes < 1 Hr. on average
  • Ruby/FFMpeg
  • CWE-918

 

Hard
SSRF via FFMPEG II
  • This exercise covers how you can read arbitrary files when an application uses ffmpeg to render videos from a video you provide
  • Completed by 110 students
  • Takes < 1 Hr. on average
  • Ruby/FFMpeg
  • CWE-918

 

Hard
XSL PHP V
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 94 students
  • Takes < 1 Hr. on average
  • PHP
  • CWE-94

 

Hard
CVE-2021-22204: Exiftool RCE
  • This exercise covers how you can gain code execution when an application uses exiftool on user-controlled files
  • 1 video
  • Completed by 158 students
  • Takes 1-2 Hrs. on average
  • CWE-74

 

Hard
DOMPDF RCE IV
  • This exercise covers the automation of the exploitation of a vulnerability in the DOMPDF library
  • Completed by 19 students
  • Takes > 4 Hrs. on average
  • PHP