10010101 101110 11001 001 101 0111 101101 01101

WE WILL HELP YOU GET TO THE NEXT LEVEL!

TRY OUR FREE EXERCISES OR GO PRO

FILTER

	EXERCISE	AVERAGE TIME TO COMPLETE	# OF USERS COMPLETED

	CVE-2022-378xx This challenge covers the review of a CVE in a Java codebase and its patch	--	23

	CVE-2022-x0x09 This challenge covers the review of a CVE in a Java codebase and its patch	--	7

	CVE-2018-8x14 This challenge covers the review of a CVE in a Java codebase and its patch	--	10

	JSON Web Token XIV: Algorithm Confusion with ECDSA This exercise covers the exploitation of algorithm confusion when no public key is available with a ECDSA key	1-2 Hr.	4

	CVE-2014-X80X This challenge covers the review of a CVE in a Java codebase and its patch	< 1 Hr.	25

	CVE-2015-3XX0 This challenge covers the review of a CVE in a Java codebase and its patch	--	19

	CVE-2022-458X1 This challenge covers the review of a CVE in a Java codebase and its patch	--	20

	SAML: CVE-2021-21239 This exercise covers the exploitation of CVE-2021-21239 (PySAML2)	2-4 Hr.	5

	CVE-2022-393XX This challenge covers the review of a CVE in a Java codebase and its patch	< 1 Hr.	24

	CVE-2023-2XX60 This challenge covers the review of a CVE in a Java codebase and its patch	--	23

	CVE-2023-2XX61 This challenge covers the review of a CVE in a Java codebase and its patch	< 1 Hr.	18

	SAML: Malicious IDP This exercise covers the creation of a malicious IDP to forge assertion	2-4 Hr.	2

	DOMPDF RCE IV This exercise covers the automation of the exploitation of a vulnerability in the DOMPDF library	> 4 Hr.	3

	SAML: Signature Wrapping III This exercise covers the exploitation of a Signature Wrapping Issue in passport-saml (CVE-2022-39299)	1-2 Hr.	7

	XSL Java This exercise covers the exploitation of a Java application using XSL	< 1 Hr.	33

	DOMPDF RCE III This exercise covers the exploitation of a vulnerability in the DOMPDF library	2-4 Hr.	6

	XSL PHP V This exercise covers the exploitation of a PHP application using XSL	1-2 Hr.	30

	API Payments 07 This exercise covers a way to manipulate a shopping cart to lower the total amount	< 1 Hr.	201

	CVE-2021-22204: Exiftool RCE II This exercise covers how you can gain code execution when an application uses exiftool on user-controlled files	< 1 Hr.	19

	XSL PHP IV This exercise covers the exploitation of a PHP application using XSL	2-4 Hr.	37

	API Payments 06 This exercise covers a simple payments bypass.	< 1 Hr.	229

	CVE-2022-39224 This exercise covers the exploitation of CVE-2022-39224	2-4 Hr.	13

	XSL PHP III This exercise covers the exploitation of a PHP application using XSL	< 1 Hr.	59

	DOMPDF RCE II This exercise covers the exploitation of a vulnerability in the DOMPDF library	2-4 Hr.	8

	DOMPDF RCE This exercise covers the exploitation of a vulnerability in the DOMPDF library	< 1 Hr.	39

	API Payments 05 This exercise covers how to abuse a shopping cart allowing users to apply a voucher.	< 1 Hr.	258

	XSL PHP II This exercise covers the exploitation of a PHP application using XSL	< 1 Hr.	96

	API Payments 04 This exercise covers how to abuse a shopping cart allowing users to apply a voucher..	< 1 Hr.	380

	XSL PHP This exercise covers the exploitation of a PHP application using XSL	< 1 Hr.	114

	API Payments 03 This exercise covers a simple payments bypass.	< 1 Hr.	472

	Code Review 18 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	40

	CVE-2020-13xxx This challenge covers the review of a CVE and its patch	< 1 Hr.	147

	CVE-2022-3x7x1 This challenge covers the review of a CVE and its patch	< 1 Hr.	224

	CVE-2008-5x8x This challenge covers the review of a CVE and its patch	< 1 Hr.	176

	Python Snippet #02 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	656

	Java Snippet #10 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	419

	Java Snippet #11 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	405

	Java Snippet #12 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	380

	API Payments 02 This exercise covers a simple payments bypass.	< 1 Hr.	574

	GCM Nonce Reuse This challenge covers the impact of nonce reuse on GCM	< 1 Hr.	56

	CVE-2019-5x2x This challenge covers the review of a CVE and its patch	< 1 Hr.	135

	Java Snippet #07 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	626

	Java Snippet #08 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	543

	Java Snippet #09 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	413

	API Payments 01 API This exercise covers a simple payments bypass.	< 1 Hr.	720

	CVE-2022-26xx9 This challenge covers a vulnerable snippet in a real Java application	< 1 Hr.	140

	Python Snippet #07 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	520

	Python Snippet #08 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	451

	Python Snippet #09 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	508

	Mongo IDOR This challenge covers how to exploit an IDOR when Mongo IDs are used	< 1 Hr.	450

	CVE-2008-5x8x_ii This challenge covers the review of a CVE and its patch	< 1 Hr.	146

	CVE-2005-2x8x This challenge covers the review of a CVE and its patch	< 1 Hr.	157

	Python Snippet #06 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	604

	Golang Snippet #01 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	550

	Java Snippet #06 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	393

	CVE-2022-21449 jwt This exercise covers the exploitation of CVE-2022-21449 against a Java Application relying on JWT	1-2 Hr.	49

	CVE-2021-33564 Argument Injection in Ruby Dragonfly This exercise covers how you can get arbitrary file read using CVE-2021-33564 against Refinery CMS	< 1 Hr.	69

	CVE-2021-45xx9 This challenge covers a vulnerable snippet in a real Python application	< 1 Hr.	229

	PHP Snippet #07 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	556

	PHP Snippet #08 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	463

	PHP Snippet #09 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	462

	Python Snippet #03 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	564

	Python Snippet #04 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	513

	Python Snippet #05 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	545

	CVE-2021-39x3x This challenge covers the review of a CVE and its patch	< 1 Hr.	142

	CVE-2022-21724: JDBC RCE PostgreSQL This challenge covers how to gain code execution by leveraging a JDBC connection string with PostgreSQL	< 1 Hr.	84

	Java Snippet #04 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	501

	Java Snippet #05 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	453

	Ox Remote Code Execution II This exercise covers how you can gain code execution when an application using Ox to deserialize data and run on Ruby 2.7	2-4 Hr.	13

	CVE-2009-3x8x This challenge covers the review of a CVE and its patch	< 1 Hr.	186

	HTTP 41 This challenge covers how to send specific HTTP requests	< 1 Hr.	1370

	HTTP 42 This challenge covers how to send specific HTTP requests	< 1 Hr.	1386

	HTTP 43 This challenge covers how to send specific HTTP requests	< 1 Hr.	1329

	CVE-2021-381xx This challenge covers the review of a CVE and its patch	< 1 Hr.	177

	H2 RCE This challenge covers how to gain code execution by leveraging an H2 database in a Java application	< 1 Hr.	52

	TypeScript Snippet #04 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	338

	TypeScript Snippet #05 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	368

	TypeScript Snippet #06 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	298

	TypeScript Snippet #07 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	267

	TypeScript Snippet #08 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	303

	TypeScript Snippet #09 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	327

	CVE-2008-4x9x This challenge covers the review of a CVE and its patch	< 1 Hr.	175

	Log4j RCE II This exercise is one of our challenges to help you learn Java Serialisation exploitation	1-2 Hr.	101

	Log4j RCE This challenge covers the latest RCE in Log4j	1-2 Hr.	228

	CVE-2021-4379x This challenge covers the review of a CVE and its patch	< 1 Hr.	263

	API 08 This exercise covers how one can inspect HTTP responses to identify information leaks.	< 1 Hr.	713

	JDBC RCE This exercise is one of our challenges to help you learn Java Serialisation exploitation	2-4 Hr.	36

	CVE-2008-1x3x This challenge covers the review of a CVE and its patch	< 1 Hr.	261

	Golang Snippet #12 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	327

	TypeScript Snippet #01 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	475

	TypeScript Snippet #02 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	436

	TypeScript Snippet #03 This challenge covers the review of a snippet of code written in TypeScript	< 1 Hr.	419

	API 07 API Angular This exercise covers how one can inspect JavaScript code to identify information leak.	< 1 Hr.	773

	CVE-2021-40438 This challenge covers how to trigger a Server-Side Request Forgery by leveraging CVE-2021-40438	< 1 Hr.	191

	CVE-2021-41773 This challenge covers how to read arbitrary files by leveraging CVE-2021-41773	< 1 Hr.	330

	CVE-2021-41773 II This challenge covers how to gain code execution by leveraging CVE-2021-41773	1-2 Hr.	101

	HTTP 36 This challenge covers how to send specific HTTP requests	< 1 Hr.	1553

	HTTP 37 This challenge covers how to send specific HTTP requests	< 1 Hr.	1536

	HTTP 38 This challenge covers how to send specific HTTP requests	< 1 Hr.	1538

	HTTP 39 This challenge covers how to send specific HTTP requests	< 1 Hr.	1521

	HTTP 40 This challenge covers how to send specific HTTP requests	< 1 Hr.	1537

	CVE-2006-4xxx This challenge covers the review of a CVE and its patch	< 1 Hr.	252

	CVE-2006-4xxx_ii This challenge covers the review of a CVE and its patch	< 1 Hr.	179

	PHP Snippet #04 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	682

	PHP Snippet #05 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	624

	PHP Snippet #06 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	685

	API 06 API Angular This exercise covers how one can inspect JavaScript code to identify unused endpoints.	< 1 Hr.	883

	CVE-2021-37xxx This challenge covers the review of a CVE and its patch	< 1 Hr.	196

	PHP Snippet #01 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	1072

	PHP Snippet #02 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	889

	PHP Snippet #03 This challenge covers the review of a snippet of code written in PHP	< 1 Hr.	712

	HTTP 31 This challenge covers how to send specific HTTP requests	< 1 Hr.	1641

	HTTP 32 This challenge covers how to send specific HTTP requests	< 1 Hr.	1626

	HTTP 35 This challenge covers how to send specific HTTP requests	< 1 Hr.	1589

	HTTP 34 This challenge covers how to send specific HTTP requests	< 1 Hr.	1595

	HTTP 33 This challenge covers how to send specific HTTP requests	< 1 Hr.	1617

	API 05 API Angular This exercise covers how one can inspect JavaScript code to identify unused endpoints.	< 1 Hr.	1076

	API 04 API Angular This exercise covers how one can inspect JavaScript code to identify unused endpoints.	< 1 Hr.	1136

	Golang Snippet #02 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	516

	Golang Snippet #03 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	413

	Golang Snippet #04 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	480

	Golang Snippet #05 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	439

	Golang Snippet #06 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	371

	Golang Snippet #07 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	397

	Golang Snippet #08 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	369

	Golang Snippet #09 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	350

	Golang Snippet #10 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	376

	Golang Snippet #11 This challenge covers the review of a snippet of code written in Golang	< 1 Hr.	368

	Javascript Snippet #01 This challenge covers the review of a snippet of code written in JavaScript	< 1 Hr.	885

	Javascript Snippet #02 This challenge covers the review of a snippet of code written in JavaScript	< 1 Hr.	691

	Javascript Snippet #03 This challenge covers the review of a snippet of code written in JavaScript	< 1 Hr.	696

	Javascript Snippet #04 This challenge covers the review of a snippet of code written in JavaScript	< 1 Hr.	636

	Javascript Snippet #05 This challenge covers the review of a snippet of code written in JavaScript	< 1 Hr.	653

	Javascript Snippet #06 This challenge covers the review of a snippet of code written in JavaScript	< 1 Hr.	599

	Javascript Snippet #07 This challenge covers the review of a snippet of code written in JavaScript	< 1 Hr.	608

	Python Snippet #01 This challenge covers the review of a snippet of code written in Python	< 1 Hr.	841

	Ruby Snippet #01 This challenge covers the review of a snippet of code written in Ruby	1-2 Hr.	268

	Ruby Snippet #02 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	287

	Ruby Snippet #03 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	307

	Ruby Snippet #04 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	280

	Ruby Snippet #05 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	304

	Ruby Snippet #06 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	293

	Ruby Snippet #07 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	235

	Ruby Snippet #08 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	264

	Ruby Snippet #09 This challenge covers the review of a snippet of code written in Ruby	< 1 Hr.	245

	HTTP 26 This challenge covers how to send specific HTTP requests	< 1 Hr.	1791

	HTTP 27 This challenge covers how to send specific HTTP requests	< 1 Hr.	1763

	HTTP 28 This challenge covers how to send specific HTTP requests	< 1 Hr.	1734

	HTTP 29 This challenge covers how to send specific HTTP requests	< 1 Hr.	1693

	HTTP 30 This challenge covers how to send specific HTTP requests	< 1 Hr.	1656

	CVE-2020-17xx7 This challenge covers the review of a CVE and its patch	< 1 Hr.	324

	Ox Remote Code Execution This exercise covers how you can gain code execution when an application using Ox to deserialize data and run on Ruby 2.3	2-4 Hr.	22

	CVE-2020-9x9x This challenge covers the review of a CVE and its patch	< 1 Hr.	254

	HTTP 21 This challenge covers how to send specific HTTP requests	< 1 Hr.	1897

	HTTP 22 This challenge covers how to send specific HTTP requests	< 1 Hr.	1870

	HTTP 23 This challenge covers how to send specific HTTP requests	< 1 Hr.	1842

	HTTP 24 This challenge covers how to send specific HTTP requests	< 1 Hr.	1839

	HTTP 25 This challenge covers how to send specific HTTP requests	< 1 Hr.	1834

	HTTP 16 This challenge covers how to send specific HTTP requests	< 1 Hr.	1987

	HTTP 20 This challenge covers how to send specific HTTP requests	< 1 Hr.	1906

	HTTP 18 This challenge covers how to send specific HTTP requests	< 1 Hr.	1962

	HTTP 19 This challenge covers how to send specific HTTP requests	< 1 Hr.	1930

	HTTP 17 This challenge covers how to send specific HTTP requests	< 1 Hr.	1974

	CVE-2020-17xx8 This challenge covers the review of a CVE and its patch	< 1 Hr.	221

	CVE-2021-22204: Exiftool RCE This exercise covers how you can gain code execution when an application uses exiftool on user-controlled files	1-2 Hr.	112

	SSRF via FFMPEG II This exercise covers how you can read abitrary files when an application use ffmpeg to render videos from a video you provide	< 1 Hr.	86

	API 03 API This exercise is the API version of an exercise you already solved in another badge. You should use it to get more confident with discovering vulnerabilities without any hint on what to look for.	< 1 Hr.	1145

	CVE-2020-11xxx This challenge covers the review of a CVE and its patch	< 1 Hr.	239

	OAuth2: Authorization Server XSS II This exercise covers the exploitation of a XSS in the Authorization server	< 1 Hr.	183

	HTTP 11 This challenge covers how to send specific HTTP requests	< 1 Hr.	2138

	HTTP 15 This challenge covers how to send specific HTTP requests	< 1 Hr.	2060

	HTTP 12 This challenge covers how to send specific HTTP requests	< 1 Hr.	2118

	HTTP 13 This challenge covers how to send specific HTTP requests	< 1 Hr.	2087

	HTTP 14 This challenge covers how to send specific HTTP requests	< 1 Hr.	2065

	API 02 API This exercise is the API version of an exercise you already solved in another badge. You should use it to get more confident with discovering vulnerabilities without any hint on what to look for.	< 1 Hr.	1602

	Express Local File Read This exercise covers how an insecure to render can be used to gain local file read with Express	< 1 Hr.	227

	OAuth2: Authorization Server XSS This exercise covers the exploitation of a XSS in the Authorization server	< 1 Hr.	235

	HTTP 10 This challenge covers how to send specific HTTP requests	< 1 Hr.	2231

	HTTP 09 This challenge covers how to send specific HTTP requests	< 1 Hr.	2267

	HTTP 07 This challenge covers how to send specific HTTP requests	< 1 Hr.	2363

	HTTP 06 This challenge covers how to send specific HTTP requests	< 1 Hr.	2385

	HTTP 08 This challenge covers how to send specific HTTP requests	< 1 Hr.	2296

	HTTP 03 This challenge covers how to send specific HTTP requests	< 1 Hr.	2618

	HTTP 04 This challenge covers how to send specific HTTP requests	< 1 Hr.	2541

	HTTP 05 This challenge covers how to send specific HTTP requests	< 1 Hr.	2493

	HTTP 02 This challenge covers how to send specific HTTP requests	< 1 Hr.	2722

	HTTP 01 This challenge covers how to send specific HTTP requests	< 1 Hr.	2886

	API 01 API This exercise is the API version of an exercise you already solved in the Essential Badge. You should use it to get more confident with discovering vulnerabilities without any hint on what to look for.	< 1 Hr.	1971

	JSON Web Token XIII jwt This exercise covers the exploitation of algorithm confusion when no public key is available	< 1 Hr.	91

	SAML: Comment Injection II This exercise covers the exploitation of a comment injection vulnerability in SAML	< 1 Hr.	367

	Recon 24 In this challenge, you need to look for a file named key.txt in the place used to serve the assets for the main website	< 1 Hr.	2378

	Recon 25 In this challenge, you need to look for a file named key2.txt in the place used to serve the assets for the main website	1-2 Hr.	1472

	Recon 26 In this challenge, you need to look for a key in the JavaScript used by the website	< 1 Hr.	2368

	SSRF via FFMPEG This exercise covers how you can read abitrary files when an application use ffmpeg to render videos from a video you provide	1-2 Hr.	178

	SAML: Signature Wrapping II This exercise covers how one can use Signature Wrapping to become arbitrary users.	< 1 Hr.	269

	RCE via argument injection This exercise covers a remote command execution vulnerability in which an attacker can only inject arguments	2-4 Hr.	25

	Code Review 16 This exercise is one of our challenges to help you learn how to review real source code	< 1 Hr.	119

	SAML: Signature Wrapping This exercise covers how one can use Signature Wrapping to become arbitrary users.	< 1 Hr.	354

	Recon 20 In this challenge, you need to look at the branches in repo3	< 1 Hr.	2553

	Recon 21 In this challenge, you need to look at the information in the branches for repo4	< 1 Hr.	2512

	Recon 22 In this challenge, you need to look in repo9 for deleted files	< 1 Hr.	2366

	Recon 23 In this challenge, you need to look for sensitive information in commit messages	< 1 Hr.	2390

	SAML: SAMLResponse forwarding This exercise covers how one can pass the SAMLResponse from one Service Provider to another Service Provider.	< 1 Hr.	315

	CGI and Signature This exercise covers the exploitation of a vulnerable CGI.	< 1 Hr.	129

	Recon 17 In this challenge, you need to look at the name of the developer used in the repository test1	< 1 Hr.	2727

	Recon 18 In this challenge, you need to look at the public repository of the developers in the organisation	< 1 Hr.	2581

	Recon 19 In this challenge, you need to look at the email addresses used for commits in the repository repo7	< 1 Hr.	2391

	Code Review 15 This exercise is one of our challenges to help you learn how to review real source code	< 1 Hr.	121

	Code Review 14 This exercise is one of our challenges to help you learn how to review real source code	< 1 Hr.	129

	CVE-2020-14343: PyYAML unsafe loader This exercise covers how you can gain code execution when an application use a vulnerable version of PyYAML and relies on load()	< 1 Hr.	199

	OAuth2: State Fixation This exercise covers the exploitation of a state fixation in the OAuth2 Client	1-2 Hr.	278

	Code Review 13 This exercise is one of our challenges to help you learn how to review real source code	2-4 Hr.	76

	CVE-2020-7115: Aruba Clearpass RCE This exercise covers a remote command execution issue on Aruba Clearpass RCE	1-2 Hr.	132

	Code Review 12 This exercise is one of our challenges to help you learn how to review real source code	< 1 Hr.	166

	OAuth2: Predictable State II This exercise covers the exploitation of predictable state in the OAuth2 Client	1-2 Hr.	191

	Recon 13 In this challenge, you need to find the TXT record linked to key.z.hackycorp.com	< 1 Hr.	3273

	Recon 14 In this challenge, you need to find a TXT record by doing a zone transfer on z.hackycorp.com	< 1 Hr.	2967

	Recon 15 In this challenge, you need to find a TXT record by doing a zone transfer on the internal zone "int"	< 1 Hr.	2543

	Recon 16 In this challenge, you need to find the version of Bind used	< 1 Hr.	2755

	EDDSA vulnerability in Monocypher crypto This exercise covers the exploitation of a vulnerability impacting Monocypher.	1-2 Hr.	86

	Code Review 11 This exercise is one of our challenges to help you learn how to review real source code	2-4 Hr.	47

	OAuth2: Predictable State This exercise covers the exploitation of predictable state in the OAuth2 Client	2-4 Hr.	208

	Code Review 10 This exercise is one of our challenges to help you learn how to review real source code	< 1 Hr.	122

	Recon 11	< 1 Hr.	2874

	Recon 12	< 1 Hr.	3276

	Unicode and NFKC This exercise covers how can leverage unicode to get exploit a directory traversal	< 1 Hr.	197

	SAML: Trusted Embedded Key This exercise covers the exploitation of a service provider (SP) that doesn't check the certificate provided in the SAMLResponse	< 1 Hr.	338

	Recon 06 This exercise covers default vhost	< 1 Hr.	5728

	Recon 07 This exercise covers default TLS vhost	< 1 Hr.	5091

	Recon 08 This exercise covers aliases in TLS certificates	< 1 Hr.	4562

	CVE-2020-8163: Rails local name RCE This exercise details the exploitation of CVE-2020-8163 to gain code execution	2-4 Hr.	158

	SAML: Known Key This exercise covers the exploitation of a known key in SAML	1-2 Hr.	344

	Code Review 09 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	90

	Recon 04 This exercise covers common interesting directories	< 1 Hr.	7653

	Recon 05 This exercise covers simple directory bruteforcing	< 1 Hr.	5773

	Recon 01 This exercise covers 404 error pages	< 1 Hr.	10192

	OAuth2: Client Server XSS This exercise covers the exploitation of a Cross-Site Scripting in the OAuth2 Client Server	1-2 Hr.	264

	Zip symlink This exercise covers how you can create a malicious Zip file and use it to gain access to sensitive files.	< 1 Hr.	433

	Code Review 08 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	116

	SAML: Comment Injection This exercise covers the exploitation of a comment injection vulnerability in SAML	< 1 Hr.	1192

	Unicode and Downcase This exercise covers how you can use unicode to gain access to an admin account.	< 1 Hr.	442

	Code Review 07 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	116

	Java Serialize 01 This exercise is one of our challenges to help you learn Java Serialisation exploitation	< 1 Hr.	263

	Unicode and Uppercase This exercise covers how you can use unicode to gain access to an admin account.	< 1 Hr.	500

	Code Review 06 This exercise is one of our challenges to help you learn how to review real source code	2-4 Hr.	57

	Cross-Site Leak This exercise covers how one can use Cross-Site Leak to recover sensitive information	2-4 Hr.	455

	From SQL injection to Shell III: PostgreSQL Edition SQL Injection This exercise covers how to gain access to an administration interface using SQL injection followed by how to get command execution using Ghostscript	2-4 Hr.	128

	OAuth2: Client CSRF II This exercise covers the exploitation of a CSRF in the OAuth2 Client	2-4 Hr.	376

	XSS Include XSS This exercise covers how one can use Cross-Site-Scripting Include to leak information.	< 1 Hr.	1041

	OAuth2: Client CSRF This exercise covers the exploitation of a CSRF in the OAuth2 Client	< 1 Hr.	771

	Code Review 05 This exercise is one of our challenges to help you learn how to review real source code	2-4 Hr.	90

	Code Review 04 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	190

	JS Prototype Pollution This exercise covers how to exploit Prototype Pollution against a JavaScript application	< 1 Hr.	678

	OAuth2: Authorization Server CSRF This exercise covers the exploitation of a CSRF in the Authorization server	1-2 Hr.	904

	Code Review 03 This exercise is one of our challenges to help you learn how to review real source code	2-4 Hr.	104

	SSRF in PDF generation This exercise covers how you can read arbitrary files when an application generates pdf from a link you provide	< 1 Hr.	692

	OAuth2: Github HTTP HEAD This exercise covers the exploitation of the HTTP HEAD issue impacting Github in 2019	1-2 Hr.	367

	SVG XSS This exercise covers how one can use SVG to trigger a Cross-Site-Scripting.	< 1 Hr.	1430

	Apache Pluto RCE This exercise covers how you can gain code execution in Apache Pluto 3.0.0 due to an issue in the authorisation logic	< 1 Hr.	406

	JSON Cross-Site Request Forgery This exercise details the exploitation of a Cross-Site Request Forgery when JSON is used	< 1 Hr.	1216

	Cross-Site Request Forgery This exercise details the exploitation of a Cross-Site Request Forgery to gain access to sensitive data	< 1 Hr.	1319

	Code Review 02 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	229

	postMessage() IV This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the origin and X-Frame-Options is used	< 1 Hr.	763

	Spring Actuators This exercise covers how you can gain code execution using Spring Actuators when Spring Cloud is used.	1-2 Hr.	212

	postMessage() III This exercise covers how insecure calls to the JavaScript function postMessage() can be used to trigger a Cross-Site Scripting	1-2 Hr.	777

	postMessage() II This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the origin	< 1 Hr.	861

	PHP phar:// This exercise covers how the PHP phar:// handler can be used to gain code execution using PHP unserialize.	< 1 Hr.	264

	Signing Oracle This exercise covers how a signing oracle can be used to bypass authorization in place	< 1 Hr.	625

	Length Extension Attack This exercise covers how to use a length extension attack to exploit a directory traversal vulnerability	1-2 Hr.	557

	JSON Web Encryption This exercise covers how you can create your own JWE if you have access to the public key used by the se rver	< 1 Hr.	403

	postMessage() This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information	< 1 Hr.	974

	CVE-2019-5418 This exercise details the exploitation of CVE-2019-5418 to get code execution	1-2 Hr.	372

	Cross-Site WebSocket Hijacking This exercise covers Cross-Site WebSocket Hijacking and how it can be used to gain access to sensitive information	< 1 Hr.	896

	JWT XII jwt This exercise covers how to use the x5u header to bypass an authentication based on JWT.	1-2 Hr.	515

	Cross-Origin Resource Sharing II This exercise covers Cross-Origin Resource Sharing and how it can be used to get access to sensitive data.	< 1 Hr.	841

	JWT XI jwt This exercise covers how to use the jku header to bypass an authentication based on JWT.	1-2 Hr.	513

	cve-2019-5420 II This exercise details the exploitation of CVE-2019-5420 to gain code execution	1-2 Hr.	421

	OAuth2: Client OpenRedirect This exercise covers the exploitation of an OpenRedirect in the OAuth2 Client	< 1 Hr.	689

	CVE-2019-5420 This exercise details the exploitation of CVE-2019-5420 to forge a session as another user	2-4 Hr.	680

	JWT X jwt This exercise covers how to use the jku header to bypass an authentication based on JWT.	< 1 Hr.	583

	GraphQL: SQL Injection This exercise covers how to use introspection and a SQL injection to get access to additional information in GraphQL.	1-2 Hr.	1058

	OAuth2: Authorization Server OpenRedirect This exercise covers the exploitation of an OpenRedirect in the Authorization Server	< 1 Hr.	792

	JWT IX jwt This exercise covers how to use the jku header to bypass an authentication based on JWT.	< 1 Hr.	682

	Gogs RCE II This exercise covers how to get code execution against the Git self hosted tool: Gogs.	< 1 Hr.	455

	JWT VIII jwt This exercise covers how to use the jku header to bypass an authentication based on JWT.	1-2 Hr.	731

	SAML: Signature Stripping This exercise covers the exploitation of a signature stripping vulnerability in SAML	< 1 Hr.	1562

	GraphQL Introspection This exercise covers how to use introspection to get access to additional information in GraphQL.	< 1 Hr.	1816

	Gogs RCE This exercise covers how to get code execution against the Git self hosted tool: Gogs.	1-2 Hr.	517

	Android 07 This exercise will guide through the process of reversing simple obfuscated Android code	1-2 Hr.	1116

	Android 06 This exercise will guide through the process of reversing simple obfuscated Android code	1-2 Hr.	1302

	Android 05 This exercise will guide through the process of reversing simple obfuscated Android code	1-2 Hr.	1545

	Ruby 2.x Universal RCE Deserialization Gadget Chain This exercise covers how to get code execution by using a Ruby Universal Gadget when an attacker controls the data passed to Marshal.load()	< 1 Hr.	1116

	CVE-2018-10933: LibSSH auth bypass This exercise covers how one can bypass the authentication of an SSH server based on libssh to gain a shell on the impacted system	--	0

	Android 04 This exercise will guide through the process of reversing simple Android code	< 1 Hr.	1990

	Android 03 This exercise will guide through the process of extracting simple information from an APK	< 1 Hr.	2694

	From SQL injection to Shell III SQL Injection This exercise covers how to gain access to an administration interface using SQL injection followed by how to get command execution using ImageTragick	1-2 Hr.	872

	Android 02 This exercise will guide through the process of extracting data from a simple database used by an Android app	< 1 Hr.	2930

	IDOR to Shell This exercise covers how to get code execution by chaining vulnerabilities in a Ruby-on-Rails application	1-2 Hr.	801

	Android 01 This exercise will guide through the process of extracting simple information from an APK	< 1 Hr.	3125

	Introduction to CSP This exercise details the exploitation of a XSS in a simple web application that uses Content Security Policy	< 1 Hr.	2095

	CVE-2018-11235: Git Submodule RCE This exercise details the exploitation of a vulnerability in Git Sub module that can be used to get command execution	2-4 Hr.	420

	Git Information Leak II This exercise details how to retrieve information from an exposed .git directory on a web server. This time, the directly listing is disabled	< 1 Hr.	2145

	Git Information Leak This exercise details how to retrieve information from an exposed .git directory on a web server	< 1 Hr.	2839

	JWT VII jwt This exercise covers the exploitation of a website using JWT for session without verifying the signature	< 1 Hr.	2714

	CVE-2016-5386: HTTPoxy/Golang HTTProxy namespace conflict This exercise covers the exploitation of HTTPoxy against an old version of Golang	< 1 Hr.	748

	Unix 31 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12014

	Unix 30 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12056

	Unix 25 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12620

	Unix 32 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12000

	Unix 34 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	11945

	Unix 33 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	11977

	Unix 27 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12472

	Unix 29 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12405

	Unix 28 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12421

	Unix 26 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12542

	CBC-MAC II crypto This exercise covers the exploitation of an application using CBC-MAC when an attacker has control over the IV	1-2 Hr.	1427

	JWT VI jwt This exercise covers the exploitation of an injection in the kid element of a JWT. This injection can be used to bypass the signature mechanism	< 1 Hr.	2097

	CVE-2018-6574: go get RCE This exercise covers a remote command execution in Golang's go get command.	< 1 Hr.	727

	Unix 11 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	16775

	Unix 12 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	16313

	Unix 13 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	15620

	Unix 14 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	15260

	Unix 15 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	13963

	Unix 16 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	13656

	Unix 17 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	13864

	Unix 18 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	13796

	Unix 19 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	13709

	Unix 20 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12863

	Unix 21 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	13012

	Unix 22 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12891

	Unix 23 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12688

	Unix 24 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	12622

	JWT V jwt This exercise covers the exploitation of a trivial secret used to sign JWT tokens.	< 1 Hr.	2505

	CVE-2018-0114 jwt This exercise details the exploitation of a vulnerability in Cisco's node-jose, a JavaScript library created to manage JWT	2-4 Hr.	1517

	JWT IV jwt This exercise covers the exploitation of a vulnerability similar to the recent CVE-2017-17405 impacting Ruby Net::FTP	< 1 Hr.	2224

	CBC-MAC crypto This exercise covers the exploitation of signature of non-fixed size messages with CBC-MAC	1-2 Hr.	1388

	JWT III jwt This exercise covers the exploitation of an issue in the usage of JWT token	1-2 Hr.	2382

	Code Execution 09 This exercise is one of our challenges on Code Execution	< 1 Hr.	9265

	Server Side Template Injection 02 This exercise is one of our challenges on Server-Side Template Injection	< 1 Hr.	7246

	MongoDB Injection 02 This exercise is one of our challenges on vulnerabilities related to MongoDB	1-2 Hr.	7278

	Authorization 06 This exercise is one of our challenges on Authorisation issues	< 1 Hr.	12498

	Code Execution 08 This exercise is one of our challenges on Code Execution	< 1 Hr.	9358

	Authorization 04 This exercise is one of our challenges on Authorisation issues	< 1 Hr.	13498

	Authorization 05 This exercise is one of our challenges on Authorisation issues	< 1 Hr.	13018

	Command Execution 03 This exercise is one of our challenges on Command Execution	< 1 Hr.	9644

	Server Side Template Injection 01 This exercise is one of our challenges on Server-Side Template Injection	< 1 Hr.	7234

	Code Execution 05 This exercise is one of our challenges on Code Execution	< 1 Hr.	10675

	Code Execution 06 This exercise is one of our challenges on Code Execution	< 1 Hr.	10447

	Code Execution 07 This exercise is one of our challenges on Code Execution	< 1 Hr.	10230

	Introduction to code review This exercise covers the different ways to perform code review. It also contains a simple application to review to help you get started.	--	0

	S2-052 This exercise covers the exploitation of the Struts S2-052 vulnerability	< 1 Hr.	2139

	SQL Injection 06 SQL Injection This exercise is one of our challenges on SQL Injections	< 1 Hr.	7919

	XML Attacks 01 This exercise is one of our challenges on vulnerabilities related to XML processing	< 1 Hr.	7678

	XML Attacks 02 This exercise is one of our challenges on vulnerabilities related to XML processing	< 1 Hr.	7275

	SQL Injection 04 SQL Injection This exercise is one of our challenges on SQL Injections	< 1 Hr.	8387

	SQL Injection 05 SQL Injection This exercise is one of our challenges on SQL Injections	< 1 Hr.	8312

	SQL Injection 01 SQL Injection This exercise is one of our challenges on SQL Injections	< 1 Hr.	9289

	SQL Injection 02 SQL Injection This exercise is one of our challenges on SQL Injections	< 1 Hr.	8995

	SQL Injection 03 SQL Injection This exercise is one of our challenges on SQL Injections	< 1 Hr.	8765

	Code Execution 02 This exercise is one of our challenges on Code Execution	< 1 Hr.	11791

	Authorization 03 This exercise is one of our challenges on Authorisation issues	< 1 Hr.	14378

	Command Execution 01 This exercise is one of our challenges on Command Execution	< 1 Hr.	10051

	Command Execution 02 This exercise is one of our challenges on Command Execution	< 1 Hr.	9756

	Server Side Request Forgery 04 This exercise is one of our challenges on Server-Side Request Forgery	< 1 Hr.	8227

	Open Redirect 01 This exercise is one of our challenges on Open Redirect	< 1 Hr.	8495

	Open Redirect 02 This exercise is one of our challenges on Open Redirect	< 1 Hr.	8217

	MongoDB Injection 01 This exercise is one of our challenges on vulnerabilities related to MongoDB	< 1 Hr.	8646

	SAML: Introduction This exercise covers the exploitation of a signature stripping vulnerability in SAML	< 1 Hr.	2144

	Server Side Request Forgery 02 This exercise is one of our challenges on Server-Side Request Forgery	< 1 Hr.	8532

	Server Side Request Forgery 03 This exercise is one of our challenges on Server-Side Request Forgery	< 1 Hr.	8501

	Server Side Request Forgery 01 This exercise is one of our challenges on Server-Side Request Forgery	< 1 Hr.	8676

	XSS 09 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	7691

	XSS 10 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	7144

	Directory Traversal 01 This exercise is one of our challenges on Directory Traversal	< 1 Hr.	10179

	Directory Traversal 02 This exercise is one of our challenges on Directory Traversal	< 1 Hr.	10025

	Directory Traversal 03 This exercise is one of our challenges on Directory Traversal	< 1 Hr.	9911

	XSS 02 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	9039

	XSS 03 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	8731

	XSS 04 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	8298

	XSS 05 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	8071

	XSS 06 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	8037

	XSS 07 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	7908

	XSS 08 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	7791

	File Upload 01 This exercise is one of our challenges on Upload vulnerabilities	< 1 Hr.	7893

	File Upload 02 This exercise is one of our challenges on Upload vulnerabilities	< 1 Hr.	7808

	XSS 01 XSS This exercise is one of our challenges on Cross-Site Scripting	< 1 Hr.	9370

	Authentication 05 This exercise is one of our challenges on Authentication issues	< 1 Hr.	14746

	Code Execution 03 This exercise is one of our challenges on Code Execution	< 1 Hr.	11226

	Code Execution 04 This exercise is one of our challenges on Code Execution	< 1 Hr.	11028

	File Include 01 This exercise is one of our challenges on File Include vulnerabilities	< 1 Hr.	9477

	File Include 02 This exercise is one of our challenges on File Include vulnerabilities	< 1 Hr.	9255

	LDAP 01 This exercise is one of our challenges on vulnerabilities related to LDAP	< 1 Hr.	9176

	LDAP 02 This exercise is one of our challenges on vulnerabilities related to LDAP	< 1 Hr.	8809

	Authentication 04 This exercise is one of our challenges on Authentication issues	< 1 Hr.	15416

	Authentication 01 This exercise is one of our challenges on Authentication issues	< 1 Hr.	16738

	Authentication 02 This exercise is one of our challenges on Authentication issues	< 1 Hr.	16164

	Authentication 03 This exercise is one of our challenges on Authentication issues	< 1 Hr.	15699

	Authorization 01 This exercise is one of our challenges on Authorisation issues	< 1 Hr.	14870

	Authorization 02 This exercise is one of our challenges on Authorisation issues	< 1 Hr.	14588

	Code Execution 01 This exercise is one of our challenges on Code Execution	< 1 Hr.	12496

	CVE-2016-10033: PHPMailer RCE This exercise covers a remote code execution vulnerability in PHPMailer	< 1 Hr.	3205

	Cipher block chaining crypto This exercise details how to tamper with data encrypted using CBC	1-2 Hr.	2482

	Struts s2-045 This exercise covers a Remote Code Execution in Struts 2.	< 1 Hr.	2383

	CVE-2016-2098 This exercise covers a remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data	< 1 Hr.	3123

	CVE-2014-4511: Gitlist RCE This exercise explains how you can exploit a vulnerability published in 2014 in Gitlist.	--	0

	ECDSA crypto This exercise covers the exploitation of a weakness in the usage of ECDSA	2-4 Hr.	310

	Werkzeug DEBUG This challenge was written for Ruxcon CTF 2015 and cover the Debug mode of Werkzeug/Flask	< 1 Hr.	1419

	Padding Oracle This exercise covers an attack against CBC mode. This attack can be used to decrypt data and re-encrypt arbitrary data	1-2 Hr.	758

	Unickle This challenge was written for Ruxcon CTF 2015. It's an SQL injection mixed with a remote code execution.	1-2 Hr.	608

	CVE-2015-3224 This exercise is a challenge written for Nullcon CTF in 2015	< 1 Hr.	1424

	Luhn This challenge was written for Ruxcon CTF 2015. It's an SQL injection with a twist	2-4 Hr.	553

	CVE-2013-0156: Rails Object Injection This exercise covers the exploitation of a code execution in Ruby-on-Rails using XML and YAML.	< 1 Hr.	3551

	JSON Web Token II jwt This exercise covers the exploitation of an issue with some implementations of JWT	1-2 Hr.	3149

	CVE-2016-0792 This exercise covers the exploitation of an Xstream vulnerability in Jenkins	< 1 Hr.	4176

	ObjectInputStream This exercise covers the exploitation of a call to readObject in a Spring application	< 1 Hr.	3812

	XMLDecoder This exercise covers the exploitation of an application using XMLDecoder	< 1 Hr.	4656

	CVE-2014-1266 This exercise covers how to intercept an HTTPs connection..	1-2 Hr.	1018

	CVE-2011-0228 This exercise covers how to intercept an HTTPs connection..	1-2 Hr.	1171

	Intercept 03 This exercise covers how to intercept an HTTPs connection with hostname verification.	< 1 Hr.	1433

	Intercept 02 This exercise covers how to intercept an HTTPs connection.	< 1 Hr.	1576

	Intercept 01 This exercise covers how to intercept an HTTP connection.	1-2 Hr.	1737

	Struts devMode This exercise covers how to get code execution when a Struts application is running in devMode	--	0

	JSON Web Token jwt This exercise covers the exploitation of a signature weakness in a JWT library.	< 1 Hr.	8665

	Cross-Origin Resource Sharing This exercise covers Cross-Origin Resource Sharing and how it can be used to bypass CSRF protection if misconfigured.	--	0

	API to Shell API This exercise covers the exploitation of PHP type confusion to bypass a signature and the exploitation of unserialize.	2-4 Hr.	3036

	Pickle Code Execution This exercise covers the exploitation of Python's pickle when used to deserialize untrusted data	< 1 Hr.	5625

	Play XML Entities This exercise covers the exploitation of a XML entities in the Play framework.	1-2 Hr.	1934

	CVE-2014-6271/Shellshock This exercise covers the exploitation of a Bash vulnerability through a CGI.	< 1 Hr.	7834

	Play Session Injection This exercise covers the exploitation of a session injection in the Play framework. This issue can be used to tamper with the content of the session while bypassing the signing mechanism	< 1 Hr.	2457

	CVE-2007-1860: mod_jk double-decoding This exercise covers the exploitation of CVE-2007-1860. This vulnerability allows an attacker to gain access to inaccessible pages using crafted requests. This is a common trick that a lot of testers miss.	1-2 Hr.	5374

	XSS and MySQL FILE XSS This exercise explains how you can use a Cross-Site Scripting vulnerability to get access to an administrator's cookies. Then how you can use his/her session to gain access to the administration to find a SQL injection and gain code execution using it.	--	0

	Electronic Code Book crypto This exercise explains how you can tamper with an encrypted cookies to access another user's account.	1-2 Hr.	5130

	Web for Pentester II This exercise is a set of the most common web vulnerabilities.	--	0

	From SQL Injection to Shell II SQL Injection This exercise explains how you can, from a blind SQL injection, gain access to the administration console. Then once in the administration console, how you can run commands on the system.	--	0

	CVE-2012-6081: MoinMoin code execution This exercise explains how you can exploit CVE-2012-6081 to gain code execution. This vulnerability was exploited to compromise Debian's wiki and Python documentation website	--	0

	Web for Pentester This exercise is a set of the most common web vulnerabilities.	--	0

	Axis2 Web service and Tomcat Manager This exercise explains the interactions between Tomcat and Apache, then it will show you how to call and attack an Axis2 Web service. Using information retrieved from this attack, you will be able to gain access to the Tomcat Manager and deploy a WebShell to gain commands execution.	--	0

	CVE-2008-1930: Wordpress 2.5 Cookie Integrity Protection Vulnerability This exercise explains how you can exploit CVE-2008-1930 to gain access to the administration interface of a Wordpress installation.	--	0

	From SQL Injection to Shell: PostgreSQL edition SQL Injection This exercise explains how you can from a SQL injection gain access to the administration console. Then in the administration console, how you can run commands on the system.	--	0

	Rack Cookies and Commands injection After a short brute force introduction, this exercise explains the tampering of rack cookie and how you can even manage to modify a signed cookie (if the secret is trivial). Using this issue, you will be able to escalate your privileges and gain commands execution.	--	0

	Linux Host Review This exercise explains how to perform a Linux host review, what and how you can check the configuration of a Linux server to ensure it is securely configured. The reviewed system is a traditional Linux-Apache-Mysql-PHP (LAMP) server used to host a blog.	--	0

	CVE-2012-2661: ActiveRecord SQL injection This exercise explains how you can exploit CVE-2012-2661 to retrieve information from a database	--	0

	CVE-2012-1823: PHP CGI This exercise explains how you can exploit CVE-2012-1823 to retrieve the source code of an application and gain code execution.	--	0

	PHP Include And Post Exploitation This exercise describes the exploitation of a local file include with limited access. Once code execution is gained, you will see some post exploitation tricks.	--	0

	From SQL Injection to Shell SQL Injection This exercise explains how you can, from a SQL injection, gain access to the administration console, then in the administration console, how you can run commands on the system.	< 1 Hr.	7168

	Code Review 01 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	362

	Introduction 01 This exercise will guide through the process of scoring an exercise to mark it as completed	< 1 Hr.	24802

	Recon 00 This exercise covers the robots.txt file	< 1 Hr.	10153

	Introduction 02 This exercise will guide through the process of scoring an exercise to mark it as completed. Finding the key is just a little bit harder than the previous exercise.	< 1 Hr.	24514

	Recon 02 This exercise covers the security.txt file	< 1 Hr.	8374

	Introduction 03 This exercise will guide through the process of scoring an exercise to mark it as completed. However, this time, you will run commands on the underlying operating system. You will need to run the score command with your UUID.	< 1 Hr.	23999

	Recon 03 This exercise covers directory listing	< 1 Hr.	7438

	Introduction 00 This exercise will guide you through the process of scoring on an exercise to get it marked as completed	< 1 Hr.	25598

	Recon 10 This exercise covers visual content discovery	< 1 Hr.	3187

	Recon 09	< 1 Hr.	5088

	Code Review 17 This exercise is one of our challenges to help you learn how to review real source code	1-2 Hr.	56

	Unix 00 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	21724

	Unix 01 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	21221

	Unix 02 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	21000

	Unix 03 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	20734

	Unix 04 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	20460

	Unix 05 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	19459

	Unix 06 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	18684

	Unix 07 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	18375

	Unix 08 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	18099

	Unix 09 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	17547

	Unix 10 This exercise is one of our challenges to help you learn more about Unix/Linux	< 1 Hr.	17088

	PCAP 01 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	6578

	PCAP 02 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	6423

	PCAP 03 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	6337

	PCAP 04 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	6100

	PCAP 05 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5987

	PCAP 06 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5897

	PCAP 07 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5842

	PCAP 08 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5796

	PCAP 09 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5763

	PCAP 10 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5456

	PCAP 11 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5453

	PCAP 12 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5438

	PCAP 13 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5486

	Java Snippet #01 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	670

	PCAP 14 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5467

	Java Snippet #02 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	603

	PCAP 15 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5456

	Java Snippet #03 This challenge covers the review of a snippet of code written in Java	< 1 Hr.	555

	PCAP 16 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5431

	PCAP 17 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5379

	PCAP 18 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5375

	PCAP 19 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5354

	PCAP 20 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5249

	PCAP 21 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5196

	PCAP 22 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5183

	PCAP 23 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5171

	PCAP 24 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5160

	PCAP 25 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5162

	PCAP 26 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5158

	PCAP 27 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5105

	PCAP 28 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5084

	PCAP 29 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5068

	PCAP 30 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5042

	PCAP 31 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	5023

	PCAP 32 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	4952

	CVE-2021-4xx50 This challenge covers the review of a CVE and its patch	< 1 Hr.	347

	PCAP 33 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	4864

	PCAP 34 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	4925

	PCAP 35 This exercise is one of our challenges to help you learn how to analyze PCAP files	< 1 Hr.	4991

	Android 08 This exercise will guide through the process of reversing simple obfuscated Android code to recover encrypted data	1-2 Hr.	1054
No search results found...