Media Badge

22 Videos
18 Exercises

The media badge is our set of exercises created to teach you how to abuse applications that allows you to upload or retrieve files in different formats: PDF, Images, Videos and use this behaviour to gain code execution or arbitrary file read

Exercises

Easy
SSRF in PDF generation
  • This exercise covers how you can read arbitrary files when an application generates pdfs from provided links
  • 1 video
  • Completed by 805 students
  • Takes < 1 Hr. on average

 

Coming soon
Easy
ODF XXE
  • This exercise covers the exploitation of an XXE in an ODF Parser
  • Takes -- on average

 

Medium
CVE-2022-39224
  • This exercise covers the exploitation of CVE-2022-39224
  • 1 video
  • Completed by 67 students
  • Takes 2-4 Hrs. on average
  • Ruby
  • CWE-78

 

Medium
XSL PHP
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 229 students
  • Takes < 1 Hr. on average
  • PHP
  • CWE-94,CWE-306

 

Medium
XSL PHP II
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 198 students
  • Takes < 1 Hr. on average
  • PHP
  • CWE-94

 

Medium
DOMPDF RCE
  • This exercise covers the exploitation of a vulnerability in the DOMPDF library
  • 2 videos
  • Completed by 119 students
  • Takes < 1 Hr. on average
  • PHP

 

Medium
XSL PHP IV
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 118 students
  • Takes 2-4 Hrs. on average
  • PHP
  • CWE-94

 

Medium
DOMPDF RCE III
  • This exercise covers the exploitation of a vulnerability in the DOMPDF library
  • 2 videos
  • Completed by 36 students
  • Takes 2-4 Hrs. on average
  • PHP

 

Medium
XSL Java
  • This exercise covers the exploitation of a Java application using XSL
  • 2 videos
  • Completed by 90 students
  • Takes < 1 Hr. on average
  • Java

 

Medium
DOMPDF RCE II
  • This exercise covers the exploitation of a vulnerability in the DOMPDF library
  • 3 videos
  • Completed by 52 students
  • Takes 2-4 Hrs. on average
  • PHP

 

Medium
XSL PHP III
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 142 students
  • Takes < 1 Hr. on average
  • PHP
  • CWE-94

 

Medium
CVE-2021-33564 Argument Injection in Ruby Dragonfly
  • This exercise covers how you can get arbitrary file read using CVE-2021-33564 against Refinery CMS
  • Completed by 115 students
  • Takes < 1 Hr. on average
  • CWE-88

 

Medium
CVE-2021-22204: Exiftool RCE II
  • This exercise covers how you can gain code execution when an application uses exiftool on user-controlled files
  • Completed by 62 students
  • Takes < 1 Hr. on average
  • CWE-94,CWE-74

 

Medium
SSRF via FFMPEG
  • This exercise covers how you can read arbitrary files when an application uses ffmpeg to render videos from a video you provide
  • Completed by 219 students
  • Takes 1-2 Hrs. on average
  • Ruby/FFMpeg
  • CWE-918

 

Hard
SSRF via FFMPEG II
  • This exercise covers how you can read arbitrary files when an application uses ffmpeg to render videos from a video you provide
  • Completed by 108 students
  • Takes < 1 Hr. on average
  • Ruby/FFMpeg
  • CWE-918

 

Hard
XSL PHP V
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 90 students
  • Takes 1-2 Hrs. on average
  • PHP
  • CWE-94

 

Hard
CVE-2021-22204: Exiftool RCE
  • This exercise covers how you can gain code execution when an application uses exiftool on user-controlled files
  • 1 video
  • Completed by 156 students
  • Takes 1-2 Hrs. on average
  • CWE-74

 

Hard
DOMPDF RCE IV
  • This exercise covers the automation of the exploitation of a vulnerability in the DOMPDF library
  • Completed by 17 students
  • Takes > 4 Hrs. on average
  • PHP