10010101 101110 11001 001 101 0111 101101 01101

WE WILL HELP YOU GET TO THE NEXT LEVEL!

TRY OUR FREE EXERCISES OR GO PRO

FILTER

	EXERCISE	AVERAGE TIME TO COMPLETE	# OF USERS COMPLETED

	CVE-2022-378xx This challenge covers the review of a CVE in a Java codebase and its patch	--	3

	CVE-2022-x0x09 This challenge covers the review of a CVE in a Java codebase and its patch	--	3

	CVE-2018-8x14 This challenge covers the review of a CVE in a Java codebase and its patch	--	3

	JSON Web Token XIV: Algorithm Confusion with ECDSA This exercise covers the exploitation of algorithm confusion when no public key is available with a ECDSA key	1-2 Hr.	3

	CVE-2014-X80X This challenge covers the review of a CVE in a Java codebase and its patch	< 1 Hr.	21

	CVE-2015-3XX0 This challenge covers the review of a CVE in a Java codebase and its patch	--	17

	CVE-2022-458X1 This challenge covers the review of a CVE in a Java codebase and its patch	--	18

	SAML: CVE-2021-21239 This exercise covers the exploitation of CVE-2021-21239 (PySAML2)	2-4 Hr.	4

	CVE-2022-393XX This challenge covers the review of a CVE in a Java codebase and its patch	--	21

	CVE-2023-2XX60 This challenge covers the review of a CVE in a Java codebase and its patch	--	22

	CVE-2023-2XX61 This challenge covers the review of a CVE in a Java codebase and its patch	< 1 Hr.	17

	SAML: Malicious IDP This exercise covers the creation of a malicious IDP to forge assertion	2-4 Hr.	2

	DOMPDF RCE IV This exercise covers the automation of the exploitation of a vulnerability in the DOMPDF library	> 4 Hr.	3

	SAML: Signature Wrapping III This exercise covers the exploitation of a Signature Wrapping Issue in passport-saml (CVE-2022-39299)	1-2 Hr.	7

	XSL Java This exercise covers the exploitation of a Java application using XSL	< 1 Hr.	31

	DOMPDF RCE III This exercise covers the exploitation of a vulnerability in the DOMPDF library	2-4 Hr.	6

	XSL PHP V This exercise covers the exploitation of a PHP application using XSL	1-2 Hr.	29

	API Payments 07 This exercise covers a way to manipulate a shopping cart to lower the total amount	< 1 Hr.	196

	CVE-2021-22204: Exiftool RCE II This exercise covers how you can gain code execution when an application uses exiftool on user-controlled files	< 1 Hr.	19

	XSL PHP IV This exercise covers the exploitation of a PHP application using XSL	2-4 Hr.	35

	API Payments 06 This exercise covers a simple payments bypass.	< 1 Hr.	223

	CVE-2022-39224 This exercise covers the exploitation of CVE-2022-39224	2-4 Hr.	13

	XSL PHP III This exercise covers the exploitation of a PHP application using XSL	< 1 Hr.	57

	DOMPDF RCE II This exercise covers the exploitation of a vulnerability in the DOMPDF library	2-4 Hr.	8

	DOMPDF RCE This exercise covers the exploitation of a vulnerability in the DOMPDF library	< 1 Hr.	39

	API Payments 05 This exercise covers how to abuse a shopping cart allowing users to apply a voucher.	< 1 Hr.	253

	XSL PHP II This exercise covers the exploitation of a PHP application using XSL	< 1 Hr.	94

	API Payments 04 This exercise covers how to abuse a shopping cart allowing users to apply a voucher..	< 1 Hr.	372

	XSL PHP This exercise covers the exploitation of a PHP application using XSL	< 1 Hr.	112

	API Payments 03 This exercise covers a simple payments bypass.	< 1 Hr.	464

	Code Review 18 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	39

	CVE-2020-13xxx This challenge covers the review of a CVE and its patch	< 1 Hr.	145

	CVE-2022-3x7x1 This challenge covers the review of a CVE and its patch	< 1 Hr.	220

	CVE-2008-5x8x This challenge covers the review of a CVE and its patch	< 1 Hr.	175

	Python Snippet #02 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	647

	Java Snippet #10 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	416

	Java Snippet #11 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	400

	Java Snippet #12 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	377

	API Payments 02 This exercise covers a simple payments bypass.	< 1 Hr.	566

	GCM Nonce Reuse This challenge covers the impact of nonce reuse on GCM	< 1 Hr.	56

	CVE-2019-5x2x This challenge covers the review of a CVE and its patch	< 1 Hr.	135

	Java Snippet #07 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	617

	Java Snippet #08 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	536

	Java Snippet #09 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	410

	API Payments 01 API This exercise covers a simple payments bypass.	< 1 Hr.	710

	CVE-2022-26xx9 This challenge covers a vulnerable snippet in a real Java application	< 1 Hr.	138

	Python Snippet #07 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	516

	Python Snippet #08 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	446

	Python Snippet #09 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	503

	Mongo IDOR This challenge covers how to exploit an IDOR when Mongo IDs are used	< 1 Hr.	441

	CVE-2008-5x8x_ii This challenge covers the review of a CVE and its patch	< 1 Hr.	146

	CVE-2005-2x8x This challenge covers the review of a CVE and its patch	< 1 Hr.	155

	Python Snippet #06 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	598

	Golang Snippet #01 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	544

	Java Snippet #06 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	389

	CVE-2022-21449 jwt This exercise covers the exploitation of CVE-2022-21449 against a Java Application relying on JWT	1-2 Hr.	48

	CVE-2021-33564 Argument Injection in Ruby Dragonfly This exercise covers how you can get arbitrary file read using CVE-2021-33564 against Refinery CMS	< 1 Hr.	69

	CVE-2021-45xx9 This challenge covers a vulnerable snippet in a real Python application	< 1 Hr.	226

	PHP Snippet #07 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	549

	PHP Snippet #08 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	460

	PHP Snippet #09 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	459

	Python Snippet #03 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	557

	Python Snippet #04 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	506

	Python Snippet #05 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	539

	CVE-2021-39x3x This challenge covers the review of a CVE and its patch	< 1 Hr.	140

	CVE-2022-21724: JDBC RCE PostgreSQL This challenge covers how to gain code execution by leveraging a JDBC connection string with PostgreSQL	< 1 Hr.	84

	Java Snippet #04 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	497

	Java Snippet #05 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	451

	Ox Remote Code Execution II This exercise covers how you can gain code execution when an application using Ox to deserialize data and run on Ruby 2.7	2-4 Hr.	13

	CVE-2009-3x8x This challenge covers the review of a CVE and its patch	< 1 Hr.	185

	HTTP 41 This challenge covers how to send specific HTTP requests	< 1 Hr.	1362

	HTTP 42 This challenge covers how to send specific HTTP requests	< 1 Hr.	1378

	HTTP 43 This challenge covers how to send specific HTTP requests	< 1 Hr.	1322

	CVE-2021-381xx This challenge covers the review of a CVE and its patch	< 1 Hr.	175

	H2 RCE This challenge covers how to gain code execution by leveraging an H2 database in a Java application	< 1 Hr.	51

	TypeScript Snippet #04 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	337

	TypeScript Snippet #05 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	367

	TypeScript Snippet #06 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	295

	TypeScript Snippet #07 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	266

	TypeScript Snippet #08 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	302

	TypeScript Snippet #09 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	326

	CVE-2008-4x9x This challenge covers the review of a CVE and its patch	< 1 Hr.	172

	Log4j RCE II This exercise is one of our challenges to help you learn Java Serialisation exploitation	1-2 Hr.	99

	Log4j RCE This challenge covers the latest RCE in Log4j	1-2 Hr.	228

	CVE-2021-4379x This challenge covers the review of a CVE and its patch	< 1 Hr.	262

	API 08 This exercise covers how one can inspect HTTP responses to identify information leaks.	< 1 Hr.	707

	JDBC RCE This exercise is one of our challenges to help you learn Java Serialisation exploitation	2-4 Hr.	35

	CVE-2008-1x3x This challenge covers the review of a CVE and its patch	< 1 Hr.	259

	Golang Snippet #12 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	325

	TypeScript Snippet #01 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	474

	TypeScript Snippet #02 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	435

	TypeScript Snippet #03 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	418

	API 07 API Angular This exercise covers how one can inspect JavaScript code to identify information leak.	< 1 Hr.	767

	CVE-2021-40438 This challenge covers how to trigger a Server-Side Request Forgery by leveraging CVE-2021-40438	< 1 Hr.	191

	CVE-2021-41773 This challenge covers how to read arbitrary files by leveraging CVE-2021-41773	< 1 Hr.	330

	CVE-2021-41773 II This challenge covers how to gain code execution by leveraging CVE-2021-41773	1-2 Hr.	101

	HTTP 36 This challenge covers how to send specific HTTP requests	< 1 Hr.	1545

	HTTP 37 This challenge covers how to send specific HTTP requests	< 1 Hr.	1528

	HTTP 38 This challenge covers how to send specific HTTP requests	< 1 Hr.	1531

	HTTP 39 This challenge covers how to send specific HTTP requests	< 1 Hr.	1514

	HTTP 40 This challenge covers how to send specific HTTP requests	< 1 Hr.	1529

	CVE-2006-4xxx This challenge covers the review of a CVE and its patch	< 1 Hr.	252

	CVE-2006-4xxx_ii This challenge covers the review of a CVE and its patch	< 1 Hr.	179

	PHP Snippet #04 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	675

	PHP Snippet #05 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	618

	PHP Snippet #06 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	678

	API 06 API Angular This exercise covers how one can inspect JavaScript code to identify unused endpoints.	< 1 Hr.	874

	CVE-2021-37xxx This challenge covers the review of a CVE and its patch	< 1 Hr.	193

	PHP Snippet #01 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	1064

	PHP Snippet #02 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	884

	PHP Snippet #03 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	707

	HTTP 31 This challenge covers how to send specific HTTP requests	< 1 Hr.	1633

	HTTP 32 This challenge covers how to send specific HTTP requests	< 1 Hr.	1618

	HTTP 35 This challenge covers how to send specific HTTP requests	< 1 Hr.	1580

	HTTP 34 This challenge covers how to send specific HTTP requests	< 1 Hr.	1586

	HTTP 33 This challenge covers how to send specific HTTP requests	< 1 Hr.	1608

	API 05 API Angular This exercise covers how one can inspect JavaScript code to identify unused endpoints.	< 1 Hr.	1071

	API 04 API Angular This exercise covers how one can inspect JavaScript code to identify unused endpoints.	< 1 Hr.	1130

	Golang Snippet #02 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	512

	Golang Snippet #03 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	411

	Golang Snippet #04 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	477

	Golang Snippet #05 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	434

	Golang Snippet #06 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	367

	Golang Snippet #07 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	394

	Golang Snippet #08 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	367

	Golang Snippet #09 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	347

	Golang Snippet #10 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	373

	Golang Snippet #11 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	365

	Javascript Snippet #01 This challenge covers the review of a snippet of code written in JavaScript	< 1 Hr.	881

	Javascript Snippet #02 This challenge covers the review of a snippet of code written in JavaScript	< 1 Hr.	686

	Javascript Snippet #03 This challenge covers the review of a snippet of code written in JavaScript	< 1 Hr.	692

	Javascript Snippet #04 This challenge covers the review of a snippet of code written in JavaScript	< 1 Hr.	632

	Javascript Snippet #05 This challenge covers the review of a snippet of code written in JavaScript	< 1 Hr.	648

	Javascript Snippet #06 This challenge covers the review of a snippet of code written in JavaScript	< 1 Hr.	595

	Javascript Snippet #07 This challenge covers the review of a snippet of code written in JavaScript	< 1 Hr.	606

	Python Snippet #01 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	837

	Ruby Snippet #01 This challenge covers the review of a snippet of code written in Ruby	1-2 Hr.	265

	Ruby Snippet #02 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	286

	Ruby Snippet #03 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	306

	Ruby Snippet #04 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	280

	Ruby Snippet #05 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	303

	Ruby Snippet #06 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	291

	Ruby Snippet #07 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	235

	Ruby Snippet #08 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	264

	Ruby Snippet #09 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	245

	HTTP 26 This challenge covers how to send specific HTTP requests	< 1 Hr.	1784

	HTTP 27 This challenge covers how to send specific HTTP requests	< 1 Hr.	1756

	HTTP 28 This challenge covers how to send specific HTTP requests	< 1 Hr.	1725

	HTTP 29 This challenge covers how to send specific HTTP requests	< 1 Hr.	1684

	HTTP 30 This challenge covers how to send specific HTTP requests	< 1 Hr.	1647

	CVE-2020-17xx7 This challenge covers the review of a CVE and its patch	< 1 Hr.	321

	Ox Remote Code Execution This exercise covers how you can gain code execution when an application using Ox to deserialize data and run on Ruby 2.3	2-4 Hr.	22

	CVE-2020-9x9x This challenge covers the review of a CVE and its patch	< 1 Hr.	252

	HTTP 21 This challenge covers how to send specific HTTP requests	< 1 Hr.	1889

	HTTP 22 This challenge covers how to send specific HTTP requests	< 1 Hr.	1862

	HTTP 23 This challenge covers how to send specific HTTP requests	< 1 Hr.	1834

	HTTP 24 This challenge covers how to send specific HTTP requests	< 1 Hr.	1831

	HTTP 25 This challenge covers how to send specific HTTP requests	< 1 Hr.	1827

	HTTP 16 This challenge covers how to send specific HTTP requests	< 1 Hr.	1977

	HTTP 20 This challenge covers how to send specific HTTP requests	< 1 Hr.	1897

	HTTP 18 This challenge covers how to send specific HTTP requests	< 1 Hr.	1953

	HTTP 19 This challenge covers how to send specific HTTP requests	< 1 Hr.	1921

	HTTP 17 This challenge covers how to send specific HTTP requests	< 1 Hr.	1964

	CVE-2020-17xx8 This challenge covers the review of a CVE and its patch	< 1 Hr.	219

	CVE-2021-22204: Exiftool RCE This exercise covers how you can gain code execution when an application uses exiftool on user-controlled files	1-2 Hr.	112

	SSRF via FFMPEG II This exercise covers how you can read abitrary files when an application use ffmpeg to render videos from a video you provide	< 1 Hr.	86

	API 03 API This exercise is the API version of an exercise you already solved in another badge. You should use it to get more confident with discovering vulnerabilities without any hint on what to look for.	< 1 Hr.	1139

	CVE-2020-11xxx This challenge covers the review of a CVE and its patch	< 1 Hr.	237

	OAuth2: Authorization Server XSS II This exercise covers the exploitation of a XSS in the Authorization server	< 1 Hr.	183

	HTTP 11 This challenge covers how to send specific HTTP requests	< 1 Hr.	2126

	HTTP 15 This challenge covers how to send specific HTTP requests	< 1 Hr.	2049

	HTTP 12 This challenge covers how to send specific HTTP requests	< 1 Hr.	2107

	HTTP 13 This challenge covers how to send specific HTTP requests	< 1 Hr.	2076

	HTTP 14 This challenge covers how to send specific HTTP requests	< 1 Hr.	2055

	API 02 API This exercise is the API version of an exercise you already solved in another badge. You should use it to get more confident with discovering vulnerabilities without any hint on what to look for.	< 1 Hr.	1597

	Express Local File Read This exercise covers how an insecure to render can be used to gain local file read with Express	< 1 Hr.	226

	OAuth2: Authorization Server XSS This exercise covers the exploitation of a XSS in the Authorization server	< 1 Hr.	235

	HTTP 10 This challenge covers how to send specific HTTP requests	< 1 Hr.	2219

	HTTP 09 This challenge covers how to send specific HTTP requests	< 1 Hr.	2256

	HTTP 07 This challenge covers how to send specific HTTP requests	< 1 Hr.	2351

	HTTP 06 This challenge covers how to send specific HTTP requests	< 1 Hr.	2373

	HTTP 08 This challenge covers how to send specific HTTP requests	< 1 Hr.	2283

	HTTP 03 This challenge covers how to send specific HTTP requests	< 1 Hr.	2606

	HTTP 04 This challenge covers how to send specific HTTP requests	< 1 Hr.	2531

	HTTP 05 This challenge covers how to send specific HTTP requests	< 1 Hr.	2481

	HTTP 02 This challenge covers how to send specific HTTP requests	< 1 Hr.	2709

	HTTP 01 This challenge covers how to send specific HTTP requests	< 1 Hr.	2874

	API 01 API This exercise is the API version of an exercise you already solved in the Essential Badge. You should use it to get more confident with discovering vulnerabilities without any hint on what to look for.	< 1 Hr.	1967

	JSON Web Token XIII jwt This exercise covers the exploitation of algorithm confusion when no public key is available	< 1 Hr.	90

	SAML: Comment Injection II This exercise covers the exploitation of a comment injection vulnerability in SAML	< 1 Hr.	366

	Recon 24 In this challenge, you need to look for a file named key.txt in the place used to serve the assets for the main website	< 1 Hr.	2370

	Recon 25 In this challenge, you need to look for a file named key2.txt in the place used to serve the assets for the main website	1-2 Hr.	1465

	Recon 26 In this challenge, you need to look for a key in the JavaScript used by the website	< 1 Hr.	2360

	SSRF via FFMPEG This exercise covers how you can read abitrary files when an application use ffmpeg to render videos from a video you provide	1-2 Hr.	178

	SAML: Signature Wrapping II This exercise covers how one can use Signature Wrapping to become arbitrary users.	< 1 Hr.	269

	RCE via argument injection This exercise covers a remote command execution vulnerability in which an attacker can only inject arguments	2-4 Hr.	25

	Code Review 16 This exercise is one of our challenges to help you learn how to review real source code	< 1 Hr.	117

	SAML: Signature Wrapping This exercise covers how one can use Signature Wrapping to become arbitrary users.	< 1 Hr.	354

	Recon 20 In this challenge, you need to look at the branches in repo3	< 1 Hr.	2546

	Recon 21 In this challenge, you need to look at the information in the branches for repo4	< 1 Hr.	2505

	Recon 22 In this challenge, you need to look in repo9 for deleted files	< 1 Hr.	2358

	Recon 23 In this challenge, you need to look for sensitive information in commit messages	< 1 Hr.	2383

	SAML: SAMLResponse forwarding This exercise covers how one can pass the SAMLResponse from one Service Provider to another Service Provider.	< 1 Hr.	314

	CGI and Signature This exercise covers the exploitation of a vulnerable CGI.	< 1 Hr.	128

	Recon 17 In this challenge, you need to look at the name of the developer used in the repository test1	< 1 Hr.	2715

	Recon 18 In this challenge, you need to look at the public repository of the developers in the organisation	< 1 Hr.	2573

	Recon 19 In this challenge, you need to look at the email addresses used for commits in the repository repo7	< 1 Hr.	2384

	Code Review 15 This exercise is one of our challenges to help you learn how to review real source code	< 1 Hr.	119

	Code Review 14 This exercise is one of our challenges to help you learn how to review real source code	< 1 Hr.	127

	CVE-2020-14343: PyYAML unsafe loader This exercise covers how you can gain code execution when an application use a vulnerable version of PyYAML and relies on load()	< 1 Hr.	199

	OAuth2: State Fixation This exercise covers the exploitation of a state fixation in the OAuth2 Client	1-2 Hr.	278

	Code Review 13 This exercise is one of our challenges to help you learn how to review real source code	2-4 Hr.	75

	CVE-2020-7115: Aruba Clearpass RCE This exercise covers a remote command execution issue on Aruba Clearpass RCE	1-2 Hr.	132

	Code Review 12 This exercise is one of our challenges to help you learn how to review real source code	< 1 Hr.	164

	OAuth2: Predictable State II This exercise covers the exploitation of predictable state in the OAuth2 Client	1-2 Hr.	190

	Recon 13 In this challenge, you need to find the TXT record linked to key.z.hackycorp.com	< 1 Hr.	3257

	Recon 14 In this challenge, you need to find a TXT record by doing a zone transfer on z.hackycorp.com	< 1 Hr.	2954

	Recon 15 In this challenge, you need to find a TXT record by doing a zone transfer on the internal zone "int"	< 1 Hr.	2530

	Recon 16 In this challenge, you need to find the version of Bind used	< 1 Hr.	2743

	EDDSA vulnerability in Monocypher crypto This exercise covers the exploitation of a vulnerability impacting Monocypher.	1-2 Hr.	86

	Code Review 11 This exercise is one of our challenges to help you learn how to review real source code	2-4 Hr.	47

	OAuth2: Predictable State This exercise covers the exploitation of predictable state in the OAuth2 Client	2-4 Hr.	207

	Code Review 10 This exercise is one of our challenges to help you learn how to review real source code	< 1 Hr.	121

	Recon 11	< 1 Hr.	2862

	Recon 12	< 1 Hr.	3264

	Unicode and NFKC This exercise covers how can leverage unicode to get exploit a directory traversal	< 1 Hr.	194

	SAML: Trusted Embedded Key This exercise covers the exploitation of a service provider (SP) that doesn't check the certificate provided in the SAMLResponse	< 1 Hr.	337

	Recon 06 This exercise covers default vhost	< 1 Hr.	5699

	Recon 07 This exercise covers default TLS vhost	< 1 Hr.	5067

	Recon 08 This exercise covers aliases in TLS certificates	< 1 Hr.	4538

	CVE-2020-8163: Rails local name RCE This exercise details the exploitation of CVE-2020-8163 to gain code execution	2-4 Hr.	158

	SAML: Known Key This exercise covers the exploitation of a known key in SAML	1-2 Hr.	342

	Code Review 09 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	90

	Recon 04 This exercise covers common interesting directories	< 1 Hr.	7607

	Recon 05 This exercise covers simple directory bruteforcing	< 1 Hr.	5744

	Recon 01 This exercise covers 404 error pages	< 1 Hr.	10130

	OAuth2: Client Server XSS This exercise covers the exploitation of a Cross-Site Scripting in the OAuth2 Client Server	1-2 Hr.	264

	Zip symlink This exercise covers how you can create a malicious Zip file and use it to gain access to sensitive files.	< 1 Hr.	432

	Code Review 08 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	116

	SAML: Comment Injection This exercise covers the exploitation of a comment injection vulnerability in SAML	< 1 Hr.	1190

	Unicode and Downcase This exercise covers how you can use unicode to gain access to an admin account.	< 1 Hr.	440

	Code Review 07 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	116

	Java Serialize 01 This exercise is one of our challenges to help you learn Java Serialisation exploitation	< 1 Hr.	262

	Unicode and Uppercase This exercise covers how you can use unicode to gain access to an admin account.	< 1 Hr.	498

	Code Review 06 This exercise is one of our challenges to help you learn how to review real source code	2-4 Hr.	57

	Cross-Site Leak This exercise covers how one can use Cross-Site Leak to recover sensitive information	2-4 Hr.	455

	From SQL injection to Shell III: PostgreSQL Edition SQL Injection This exercise covers how to gain access to an administration interface using SQL injection followed by how to get command execution using Ghostscript	2-4 Hr.	127

	OAuth2: Client CSRF II This exercise covers the exploitation of a CSRF in the OAuth2 Client	2-4 Hr.	376

	XSS Include XSS This exercise covers how one can use Cross-Site-Scripting Include to leak information.	< 1 Hr.	1040

	OAuth2: Client CSRF This exercise covers the exploitation of a CSRF in the OAuth2 Client	< 1 Hr.	770

	Code Review 05 This exercise is one of our challenges to help you learn how to review real source code	2-4 Hr.	89

	Code Review 04 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	189

	JS Prototype Pollution This exercise covers how to exploit Prototype Pollution against a JavaScript application	< 1 Hr.	674

	OAuth2: Authorization Server CSRF This exercise covers the exploitation of a CSRF in the Authorization server	1-2 Hr.	903

	Code Review 03 This exercise is one of our challenges to help you learn how to review real source code	2-4 Hr.	103

	SSRF in PDF generation This exercise covers how you can read arbitrary files when an application generates pdf from a link you provide	< 1 Hr.	691

	OAuth2: Github HTTP HEAD This exercise covers the exploitation of the HTTP HEAD issue impacting Github in 2019	1-2 Hr.	367

	SVG XSS This exercise covers how one can use SVG to trigger a Cross-Site-Scripting.	< 1 Hr.	1428

	Apache Pluto RCE This exercise covers how you can gain code execution in Apache Pluto 3.0.0 due to an issue in the authorisation logic	< 1 Hr.	405

	JSON Cross-Site Request Forgery This exercise details the exploitation of a Cross-Site Request Forgery when JSON is used	< 1 Hr.	1215

	Cross-Site Request Forgery This exercise details the exploitation of a Cross-Site Request Forgery to gain access to sensitive data	< 1 Hr.	1319

	Code Review 02 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	228

	postMessage() IV This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the origin and X-Frame-Options is used	< 1 Hr.	763

	Spring Actuators This exercise covers how you can gain code execution using Spring Actuators when Spring Cloud is used.	1-2 Hr.	212

	postMessage() III This exercise covers how insecure calls to the JavaScript function postMessage() can be used to trigger a Cross-Site Scripting	1-2 Hr.	777

	postMessage() II This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the origin	< 1 Hr.	861

	PHP phar:// This exercise covers how the PHP phar:// handler can be used to gain code execution using PHP unserialize.	< 1 Hr.	264

	Signing Oracle This exercise covers how a signing oracle can be used to bypass authorization in place	< 1 Hr.	624

	Length Extension Attack This exercise covers how to use a length extension attack to exploit a directory traversal vulnerability	1-2 Hr.	556

	JSON Web Encryption This exercise covers how you can create your own JWE if you have access to the public key used by the se rver	< 1 Hr.	402

	postMessage() This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information	< 1 Hr.	974

	CVE-2019-5418 This exercise details the exploitation of CVE-2019-5418 to get code execution	1-2 Hr.	372

	Cross-Site WebSocket Hijacking This exercise covers Cross-Site WebSocket Hijacking and how it can be used to gain access to sensitive information	< 1 Hr.	895

	JWT XII jwt This exercise covers how to use the x5u header to bypass an authentication based on JWT.	1-2 Hr.	514

	Cross-Origin Resource Sharing II This exercise covers Cross-Origin Resource Sharing and how it can be used to get access to sensitive data.	< 1 Hr.	841

	JWT XI jwt This exercise covers how to use the jku header to bypass an authentication based on JWT.	1-2 Hr.	511

	cve-2019-5420 II This exercise details the exploitation of CVE-2019-5420 to gain code execution	1-2 Hr.	420

	OAuth2: Client OpenRedirect This exercise covers the exploitation of an OpenRedirect in the OAuth2 Client	< 1 Hr.	689

	CVE-2019-5420 This exercise details the exploitation of CVE-2019-5420 to forge a session as another user	2-4 Hr.	679

	JWT X jwt This exercise covers how to use the jku header to bypass an authentication based on JWT.	< 1 Hr.	581

	GraphQL: SQL Injection This exercise covers how to use introspection and a SQL injection to get access to additional information in GraphQL.	1-2 Hr.	1054

	OAuth2: Authorization Server OpenRedirect This exercise covers the exploitation of an OpenRedirect in the Authorization Server	< 1 Hr.	791

	JWT IX jwt This exercise covers how to use the jku header to bypass an authentication based on JWT.	< 1 Hr.	681

	Gogs RCE II This exercise covers how to get code execution against the Git self hosted tool: Gogs.	< 1 Hr.	454

	JWT VIII jwt This exercise covers how to use the jku header to bypass an authentication based on JWT.	1-2 Hr.	730

	SAML: Signature Stripping This exercise covers the exploitation of a signature stripping vulnerability in SAML	< 1 Hr.	1561

	GraphQL Introspection This exercise covers how to use introspection to get access to additional information in GraphQL.	< 1 Hr.	1812

	Gogs RCE This exercise covers how to get code execution against the Git self hosted tool: Gogs.	1-2 Hr.	516

	Android 07 This exercise will guide through the process of reversing simple obfuscated Android code	1-2 Hr.	1114

	Android 06 This exercise will guide through the process of reversing simple obfuscated Android code	1-2 Hr.	1298

	Android 05 This exercise will guide through the process of reversing simple obfuscated Android code	1-2 Hr.	1542

	Ruby 2.x Universal RCE Deserialization Gadget Chain This exercise covers how to get code execution by using a Ruby Universal Gadget when an attacker controls the data passed to Marshal.load()	< 1 Hr.	1114

	CVE-2018-10933: LibSSH auth bypass This exercise covers how one can bypass the authentication of an SSH server based on libssh to gain a shell on the impacted system	--	0

	Android 04 This exercise will guide through the process of reversing simple Android code	< 1 Hr.	1985

	Android 03 This exercise will guide through the process of extracting simple information from an APK	< 1 Hr.	2687

	From SQL injection to Shell III SQL Injection This exercise covers how to gain access to an administration interface using SQL injection followed by how to get command execution using ImageTragick	1-2 Hr.	870

	Android 02 This exercise will guide through the process of extracting data from a simple database used by an Android app	< 1 Hr.	2921

	IDOR to Shell This exercise covers how to get code execution by chaining vulnerabilities in a Ruby-on-Rails application	1-2 Hr.	800

	Android 01 This exercise will guide through the process of extracting simple information from an APK	< 1 Hr.	3117

	Introduction to CSP This exercise details the exploitation of a XSS in a simple web application that uses Content Security Policy	< 1 Hr.	2093

	CVE-2018-11235: Git Submodule RCE This exercise details the exploitation of a vulnerability in Git Sub module that can be used to get command execution	2-4 Hr.	420

	Git Information Leak II This exercise details how to retrieve information from an exposed .git directory on a web server. This time, the directly listing is disabled	< 1 Hr.	2144

	Git Information Leak This exercise details how to retrieve information from an exposed .git directory on a web server	< 1 Hr.	2839

	JWT VII jwt This exercise covers the exploitation of a website using JWT for session without verifying the signature	< 1 Hr.	2713

	CVE-2016-5386: HTTPoxy/Golang HTTProxy namespace conflict This exercise covers the exploitation of HTTPoxy against an old version of Golang	< 1 Hr.	748

	Unix 31 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12003

	Unix 30 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12045

	Unix 25 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12608

	Unix 32 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	11989

	Unix 34 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	11932

	Unix 33 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	11965

	Unix 27 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12460

	Unix 29 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12393

	Unix 28 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12410

	Unix 26 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12530

	CBC-MAC II crypto This exercise covers the exploitation of an application using CBC-MAC when an attacker has control over the IV	1-2 Hr.	1426

	JWT VI jwt This exercise covers the exploitation of an injection in the kid element of a JWT. This injection can be used to bypass the signature mechanism	< 1 Hr.	2094

	CVE-2018-6574: go get RCE This exercise covers a remote command execution in Golang's go get command.	< 1 Hr.	727

	Unix 11 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	16755

	Unix 12 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	16296

	Unix 13 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	15605

	Unix 14 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	15243

	Unix 15 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	13945

	Unix 16 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	13639

	Unix 17 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	13845

	Unix 18 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	13779

	Unix 19 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	13692

	Unix 20 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12851

	Unix 21 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	13000

	Unix 22 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12878

	Unix 23 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12674

	Unix 24 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12609

	JWT V jwt This exercise covers the exploitation of a trivial secret used to sign JWT tokens.	< 1 Hr.	2504

	CVE-2018-0114 jwt This exercise details the exploitation of a vulnerability in Cisco's node-jose, a JavaScript library created to manage JWT	2-4 Hr.	1515

	JWT IV jwt This exercise covers the exploitation of a vulnerability similar to the recent CVE-2017-17405 impacting Ruby Net::FTP	< 1 Hr.	2222

	CBC-MAC crypto This exercise covers the exploitation of signature of non-fixed size messages with CBC-MAC	1-2 Hr.	1387

	JWT III jwt This exercise covers the exploitation of an issue in the usage of JWT token	1-2 Hr.	2380

	Code Execution 09 This exercise is one of our challenges on Code Execution	< 1 Hr.	9252

	Server Side Template Injection 02 This exercise is one of our challenges on Server-Side Template Injection	< 1 Hr.	7232

	MongoDB Injection 02 This exercise is one of our challenges on vulnerabilities related to MongoDB	1-2 Hr.	7267

	Authorization 06 This exercise is one of our challenges on Authorisation issues	< 1 Hr.	12474

	Code Execution 08 This exercise is one of our challenges on Code Execution	< 1 Hr.	9342

	Authorization 04 This exercise is one of our challenges on Authorisation issues	< 1 Hr.	13473

	Authorization 05 This exercise is one of our challenges on Authorisation issues	< 1 Hr.	12994

	Command Execution 03 This exercise is one of our challenges on Command Execution	< 1 Hr.	9626

	Server Side Template Injection 01 This exercise is one of our challenges on Server-Side Template Injection	< 1 Hr.	7220

	Code Execution 05 This exercise is one of our challenges on Code Execution	< 1 Hr.	10657

	Code Execution 06 This exercise is one of our challenges on Code Execution	< 1 Hr.	10430

	Code Execution 07 This exercise is one of our challenges on Code Execution	< 1 Hr.	10212

	Introduction to code review This exercise covers the different ways to perform code review. It also contains a simple application to review to help you get started.	--	0

	S2-052 This exercise covers the exploitation of the Struts S2-052 vulnerability	< 1 Hr.	2139

	SQL Injection 06 SQL Injection This exercise is one of our challenges on SQL Injections	< 1 Hr.	7903

	XML Attacks 01 This exercise is one of our challenges on vulnerabilities related to XML processing	< 1 Hr.	7658

	XML Attacks 02 This exercise is one of our challenges on vulnerabilities related to XML processing	< 1 Hr.	7262

	SQL Injection 04 SQL Injection This exercise is one of our challenges on SQL Injections	< 1 Hr.	8367

	SQL Injection 05 SQL Injection This exercise is one of our challenges on SQL Injections	< 1 Hr.	8294

	SQL Injection 01 SQL Injection This exercise is one of our challenges on SQL Injections	< 1 Hr.	9264

	SQL Injection 02 SQL Injection This exercise is one of our challenges on SQL Injections	< 1 Hr.	8972

	SQL Injection 03 SQL Injection This exercise is one of our challenges on SQL Injections	< 1 Hr.	8744

	Code Execution 02 This exercise is one of our challenges on Code Execution	< 1 Hr.	11771

	Authorization 03 This exercise is one of our challenges on Authorisation issues	< 1 Hr.	14355

	Command Execution 01 This exercise is one of our challenges on Command Execution	< 1 Hr.	10036

	Command Execution 02 This exercise is one of our challenges on Command Execution	< 1 Hr.	9740

	Server Side Request Forgery 04 This exercise is one of our challenges on Server-Side Request Forgery	< 1 Hr.	8211

	Open Redirect 01 This exercise is one of our challenges on Open Redirect	< 1 Hr.	8471

	Open Redirect 02 This exercise is one of our challenges on Open Redirect	< 1 Hr.	8192

	MongoDB Injection 01 This exercise is one of our challenges on vulnerabilities related to MongoDB	< 1 Hr.	8632

	SAML: Introduction This exercise covers the exploitation of a signature stripping vulnerability in SAML	< 1 Hr.	2141

	Server Side Request Forgery 02 This exercise is one of our challenges on Server-Side Request Forgery	< 1 Hr.	8515

	Server Side Request Forgery 03 This exercise is one of our challenges on Server-Side Request Forgery	< 1 Hr.	8485

	Server Side Request Forgery 01 This exercise is one of our challenges on Server-Side Request Forgery	< 1 Hr.	8657

	XSS 09 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	7684

	XSS 10 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	7139

	Directory Traversal 01 This exercise is one of our challenges on Directory Traversal	< 1 Hr.	10157

	Directory Traversal 02 This exercise is one of our challenges on Directory Traversal	< 1 Hr.	10005

	Directory Traversal 03 This exercise is one of our challenges on Directory Traversal	< 1 Hr.	9894

	XSS 02 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	9027

	XSS 03 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	8719

	XSS 04 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	8290

	XSS 05 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	8062

	XSS 06 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	8029

	XSS 07 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	7900

	XSS 08 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	7783

	File Upload 01 This exercise is one of our challenges on Upload vulnerabilities	< 1 Hr.	7878

	File Upload 02 This exercise is one of our challenges on Upload vulnerabilities	< 1 Hr.	7794

	XSS 01 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	9359

	Authentication 05 This exercise is one of our challenges on Authentication issues	< 1 Hr.	14724

	Code Execution 03 This exercise is one of our challenges on Code Execution	< 1 Hr.	11212

	Code Execution 04 This exercise is one of our challenges on Code Execution	< 1 Hr.	11015

	File Include 01 This exercise is one of our challenges on File Include vulnerabilities	< 1 Hr.	9460

	File Include 02 This exercise is one of our challenges on File Include vulnerabilities	< 1 Hr.	9241

	LDAP 01 This exercise is one of our challenges on vulnerabilities related to LDAP	< 1 Hr.	9165

	LDAP 02 This exercise is one of our challenges on vulnerabilities related to LDAP	< 1 Hr.	8797

	Authentication 04 This exercise is one of our challenges on Authentication issues	< 1 Hr.	15396

	Authentication 01 This exercise is one of our challenges on Authentication issues	< 1 Hr.	16708

	Authentication 02 This exercise is one of our challenges on Authentication issues	< 1 Hr.	16138

	Authentication 03 This exercise is one of our challenges on Authentication issues	< 1 Hr.	15678

	Authorization 01 This exercise is one of our challenges on Authorisation issues	< 1 Hr.	14849

	Authorization 02 This exercise is one of our challenges on Authorisation issues	< 1 Hr.	14568

	Code Execution 01 This exercise is one of our challenges on Code Execution	< 1 Hr.	12478

	CVE-2016-10033: PHPMailer RCE This exercise covers a remote code execution vulnerability in PHPMailer	< 1 Hr.	3202

	Cipher block chaining crypto This exercise details how to tamper with data encrypted using CBC	1-2 Hr.	2481

	Struts s2-045 This exercise covers a Remote Code Execution in Struts 2.	< 1 Hr.	2383

	CVE-2016-2098 This exercise covers a remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data	< 1 Hr.	3120

	CVE-2014-4511: Gitlist RCE This exercise explains how you can exploit a vulnerability published in 2014 in Gitlist.	--	0

	ECDSA crypto This exercise covers the exploitation of a weakness in the usage of ECDSA	2-4 Hr.	310

	Werkzeug DEBUG This challenge was written for Ruxcon CTF 2015 and cover the Debug mode of Werkzeug/Flask	< 1 Hr.	1419

	Padding Oracle This exercise covers an attack against CBC mode. This attack can be used to decrypt data and re-encrypt arbitrary data	1-2 Hr.	758

	Unickle This challenge was written for Ruxcon CTF 2015. It's an SQL injection mixed with a remote code execution.	1-2 Hr.	608

	CVE-2015-3224 This exercise is a challenge written for Nullcon CTF in 2015	< 1 Hr.	1424

	Luhn This challenge was written for Ruxcon CTF 2015. It's an SQL injection with a twist	2-4 Hr.	553

	CVE-2013-0156: Rails Object Injection This exercise covers the exploitation of a code execution in Ruby-on-Rails using XML and YAML.	< 1 Hr.	3552

	JSON Web Token II jwt This exercise covers the exploitation of an issue with some implementations of JWT	1-2 Hr.	3149

	CVE-2016-0792 This exercise covers the exploitation of an Xstream vulnerability in Jenkins	< 1 Hr.	4176

	ObjectInputStream This exercise covers the exploitation of a call to readObject in a Spring application	< 1 Hr.	3812

	XMLDecoder This exercise covers the exploitation of an application using XMLDecoder	< 1 Hr.	4656

	CVE-2014-1266 This exercise covers how to intercept an HTTPs connection..	1-2 Hr.	1018

	CVE-2011-0228 This exercise covers how to intercept an HTTPs connection..	1-2 Hr.	1171

	Intercept 03 This exercise covers how to intercept an HTTPs connection with hostname verification.	< 1 Hr.	1433

	Intercept 02 This exercise covers how to intercept an HTTPs connection.	< 1 Hr.	1576

	Intercept 01 This exercise covers how to intercept an HTTP connection.	1-2 Hr.	1737

	Struts devMode This exercise covers how to get code execution when a Struts application is running in devMode	--	0

	JSON Web Token jwt This exercise covers the exploitation of a signature weakness in a JWT library.	< 1 Hr.	8661

	Cross-Origin Resource Sharing This exercise covers Cross-Origin Resource Sharing and how it can be used to bypass CSRF protection if misconfigured.	--	0

	API to Shell API This exercise covers the exploitation of PHP type confusion to bypass a signature and the exploitation of unserialize.	2-4 Hr.	3037

	Pickle Code Execution This exercise covers the exploitation of Python's pickle when used to deserialize untrusted data	< 1 Hr.	5622

	Play XML Entities This exercise covers the exploitation of a XML entities in the Play framework.	1-2 Hr.	1934

	CVE-2014-6271/Shellshock This exercise covers the exploitation of a Bash vulnerability through a CGI.	< 1 Hr.	7830

	Play Session Injection This exercise covers the exploitation of a session injection in the Play framework. This issue can be used to tamper with the content of the session while bypassing the signing mechanism	< 1 Hr.	2456

	CVE-2007-1860: mod_jk double-decoding This exercise covers the exploitation of CVE-2007-1860. This vulnerability allows an attacker to gain access to inaccessible pages using crafted requests. This is a common trick that a lot of testers miss.	1-2 Hr.	5372

	XSS and MySQL FILE XSS This exercise explains how you can use a Cross-Site Scripting vulnerability to get access to an administrator's cookies. Then how you can use his/her session to gain access to the administration to find a SQL injection and gain code execution using it.	--	0

	Electronic Code Book crypto This exercise explains how you can tamper with an encrypted cookies to access another user's account.	1-2 Hr.	5128

	Web for Pentester II This exercise is a set of the most common web vulnerabilities.	--	0

	From SQL Injection to Shell II SQL Injection This exercise explains how you can, from a blind SQL injection, gain access to the administration console. Then once in the administration console, how you can run commands on the system.	--	0

	CVE-2012-6081: MoinMoin code execution This exercise explains how you can exploit CVE-2012-6081 to gain code execution. This vulnerability was exploited to compromise Debian's wiki and Python documentation website	--	0

	Web for Pentester This exercise is a set of the most common web vulnerabilities.	--	0

	Axis2 Web service and Tomcat Manager This exercise explains the interactions between Tomcat and Apache, then it will show you how to call and attack an Axis2 Web service. Using information retrieved from this attack, you will be able to gain access to the Tomcat Manager and deploy a WebShell to gain commands execution.	--	0

	CVE-2008-1930: Wordpress 2.5 Cookie Integrity Protection Vulnerability This exercise explains how you can exploit CVE-2008-1930 to gain access to the administration interface of a Wordpress installation.	--	0

	From SQL Injection to Shell: PostgreSQL edition SQL Injection This exercise explains how you can from a SQL injection gain access to the administration console. Then in the administration console, how you can run commands on the system.	--	0

	Rack Cookies and Commands injection After a short brute force introduction, this exercise explains the tampering of rack cookie and how you can even manage to modify a signed cookie (if the secret is trivial). Using this issue, you will be able to escalate your privileges and gain commands execution.	--	0

	Linux Host Review This exercise explains how to perform a Linux host review, what and how you can check the configuration of a Linux server to ensure it is securely configured. The reviewed system is a traditional Linux-Apache-Mysql-PHP (LAMP) server used to host a blog.	--	0

	CVE-2012-2661: ActiveRecord SQL injection This exercise explains how you can exploit CVE-2012-2661 to retrieve information from a database	--	0

	CVE-2012-1823: PHP CGI This exercise explains how you can exploit CVE-2012-1823 to retrieve the source code of an application and gain code execution.	--	0

	PHP Include And Post Exploitation This exercise describes the exploitation of a local file include with limited access. Once code execution is gained, you will see some post exploitation tricks.	--	0

	From SQL Injection to Shell SQL Injection This exercise explains how you can, from a SQL injection, gain access to the administration console, then in the administration console, how you can run commands on the system.	< 1 Hr.	7164

	Code Review 01 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	360

	Introduction 01 This exercise will guide through the process of scoring an exercise to mark it as completed	< 1 Hr.	24759

	Recon 00 This exercise covers the robots.txt file	< 1 Hr.	10095

	Introduction 02 This exercise will guide through the process of scoring an exercise to mark it as completed. Finding the key is just a little bit harder than the previous exercise.	< 1 Hr.	24470

	Recon 02 This exercise covers the security.txt file	< 1 Hr.	8318

	Introduction 03 This exercise will guide through the process of scoring an exercise to mark it as completed. However, this time, you will run commands on the underlying operating system. You will need to run the score command with your UUID.	< 1 Hr.	23962

	Recon 03 This exercise covers directory listing	< 1 Hr.	7389

	Introduction 00 This exercise will guide you through the process of scoring on an exercise to get it marked as completed	< 1 Hr.	25553

	Recon 10 This exercise covers visual content discovery	< 1 Hr.	3173

	Recon 09	< 1 Hr.	5062

	Code Review 17 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	56

	Unix 00 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	21694

	Unix 01 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	21191

	Unix 02 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	20971

	Unix 03 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	20703

	Unix 04 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	20431

	Unix 05 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	19434

	Unix 06 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	18660

	Unix 07 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	18350

	Unix 08 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	18076

	Unix 09 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	17523

	Unix 10 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	17066

	PCAP 01 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	6567

	PCAP 02 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	6411

	PCAP 03 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	6325

	PCAP 04 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	6088

	PCAP 05 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5975

	PCAP 06 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5885

	PCAP 07 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5830

	PCAP 08 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5784

	PCAP 09 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5751

	PCAP 10 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5447

	PCAP 11 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5441

	PCAP 12 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5426

	PCAP 13 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5473

	Java Snippet #01 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	667

	PCAP 14 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5454

	Java Snippet #02 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	598

	PCAP 15 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5443

	Java Snippet #03 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	550

	PCAP 16 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5418

	PCAP 17 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5365

	PCAP 18 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5361

	PCAP 19 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5341

	PCAP 20 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5238

	PCAP 21 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5186

	PCAP 22 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5173

	PCAP 23 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5161

	PCAP 24 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5150

	PCAP 25 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5152

	PCAP 26 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5148

	PCAP 27 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5095

	PCAP 28 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5075

	PCAP 29 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5060

	PCAP 30 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5034

	PCAP 31 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5015

	PCAP 32 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	4944

	CVE-2021-4xx50 This challenge covers the review of a CVE and its patch	< 1 Hr.	346

	PCAP 33 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	4855

	PCAP 34 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	4916

	PCAP 35 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	4982

	Android 08 This exercise will guide through the process of reversing simple obfuscated Android code to recover encrypted data	1-2 Hr.	1052
No search results found...