Exercises

This challenge covers wrapping a payload in a SignedObject to bypass signature-based validation before deserialization.

This challenge covers building the Groovy1 gadget chain to reach remote code execution using only existing library classes.

The model will freely tell you the key, but a server-side output filter scans every response before it reaches you. Any response containing the key is blocked. You need to get the model to reveal the key in a form the filter does not catch.

A server-side input filter inspects every message before it reaches the AI model. Messages containing certain blocked keywords are rejected and never forwarded. If your message makes it past the filter, the model will answer freely.