Orange Badge

The orange badge is our third set of exercises. It covers a wide range of vulnerabilities targetting other clients of the applications (XSS, CSRF, CORS...)

9

Exercises

0

Completed this badge

7

CPEs

Introduction to CSP

This exercise details the exploitation of a XSS in a simple web application that uses Content Security Policy

Difficulty: EASY
  • Completed by 345 students
  • Takes Less than an hour on average

XSS and MySQL FILE Coming soon

This exercise explains how you can use a Cross-Site Scripting vulnerability to get access to an administrator's cookies. Then how you can use his/her session to gain access to the administration to find a SQL injection and gain code execution using it.

Difficulty: EASY
  • PHP/Apache/Mysql
  • Completed by 0 student
  • Takes -- on average

Brute-Force and CSRF Coming soon

This exercise details how to do a brute-force attack and how to exploit a CSRF vulnerability

Difficulty: EASY
  • PHP
  • Completed by 0 student
  • Takes -- on average

Cross-Site WebSocket Hijacking

This exercise covers Cross-Site WebSocket Hijacking and how it can be used to gain access to sensitive information

Difficulty: MEDIUM
  • Ruby/Sinatra
  • Completed by 21 students
  • Takes Between 1 and 2 hours on average

postMessage()

This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information

Difficulty: MEDIUM
  • Ruby/Sinatra
  • Completed by 11 students
  • Takes Between 1 and 2 hours on average

CVE-2018-6574: go get RCE

This exercise covers a remote command execution in Golang's go get command.

Difficulty: MEDIUM
  • Completed by 88 students
  • Takes Less than an hour on average

CVE-2016-5386: HTTPoxy

This exercise covers the exploitation of HTTPoxy against an old version of Golang

Difficulty: MEDIUM
  • 2 videos
  • Completed by 133 students
  • Takes Less than an hour on average

Cross-Origin Resource Sharing II

This exercise covers Cross-Origin Resource Sharing and how it can be used to get access to sensitive data.

Difficulty: MEDIUM
  • Ruby/Sinatra/Angular
  • Completed by 21 students
  • Takes Between 1 and 2 hours on average

CVE-2018-11235: Git Submodule RCE

This exercise details the exploitation of a vulnerability in Git Sub module that can be used to get command execution

Difficulty: HARD
  • Completed by 44 students
  • Takes Between 1 and 2 hours on average