EXERCISE | AVERAGE TIME TO COMPLETE | DIFFICULTY | # OF USERS COMPLETED | TIER | |||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Puzzle 06 | < 1 Hr. | 4 | |||||||||
Puzzle 07 | 2-4 Hr. | 4 | |||||||||
API 18
This exercise covers how to exploit an authorization issue in an API.
|
< 1 Hr. | 16 | |||||||||
API 19
This exercise covers how to exploit an authorization issue in an API.
|
< 1 Hr. | 17 | |||||||||
API 20
This exercise covers how to exploit an authorization issue in an API.
|
< 1 Hr. | 19 | |||||||||
API 16
This exercise covers how to exploit an authorization issue in an API.
|
< 1 Hr. | 23 | |||||||||
API 17
This exercise covers how to exploit an authorization issue in an API.
|
< 1 Hr. | 20 | |||||||||
GraphQL Authorization 01
This exercise covers a simple authorization issue in a GraphQL application.
|
< 1 Hr. | 30 | |||||||||
GraphQL Authorization 02
This exercise covers a simple authorization issue in a GraphQL application.
|
< 1 Hr. | 28 | |||||||||
Golang Code Review #01
This challenge covers the review of a snippet of code written in Golang.
|
< 1 Hr. | 33 | |||||||||
Golang Code Review #03
This challenge covers the review of a snippet of code written in Golang.
|
< 1 Hr. | 22 | |||||||||
Golang Code Review #02
This challenge covers the review of a snippet of code written in Golang.
|
-- | 26 | |||||||||
CVE-2022-2X8XX
This challenge covers the review of a CVE in a Golang codebase and its patch
|
< 1 Hr. | 37 | |||||||||
CVE-2022-X10X8
This challenge covers the review of a CVE in a Golang codebase and its patch
|
-- | 34 | |||||||||
CVE-2024-X90X6
This challenge covers the review of a CVE in a Golang codebase and its patch
|
-- | 29 | |||||||||
ORM LEAK: SQLite
This exercise covers how to exploit an ORM leak vulnerability
|
< 1 Hr. | 19 | |||||||||
CVE-2022-X87X
This challenge covers the review of a CVE in a Golang codebase and its patch
|
-- | 32 | |||||||||
CVE-2023-51XX2
This challenge covers the review of a CVE in a Golang codebase and its patch
|
-- | 36 | |||||||||
CVE-2024-2791X
This challenge covers the review of a CVE in a Golang codebase and its patch
|
-- | 32 | |||||||||
ORM LEAK 02
This exercise covers how to exploit an ORM leak vulnerability
|
< 1 Hr. | 28 | |||||||||
Puzzle 05 | 1-2 Hr. | 14 | |||||||||
CVE-2022-2X24X
This challenge covers the review of a CVE in a Java codebase and its patch
|
-- | 41 | |||||||||
CVE-2023-3X4X6
This challenge covers the review of a CVE in a Java codebase and its patch
|
-- | 39 | |||||||||
CVE-2022-4x3x5
This challenge covers the review of a CVE in a Java codebase and its patch
|
-- | 34 | |||||||||
Puzzle 03 | 1-2 Hr. | 14 | |||||||||
Java Code Review 14 | -- | 29 | |||||||||
Java Code Review 15 | -- | 27 | |||||||||
Java Code Review 16 | < 1 Hr. | 22 | |||||||||
ORM LEAK 01
This exercise covers how to exploit a simple ORM leak.
|
1-2 Hr. | 46 | |||||||||
Java Code Review 11
This challenge covers the review of a simple codebase in Java
|
-- | 30 | |||||||||
Java Code Review 12 | -- | 30 | |||||||||
Java Code Review 13 | < 1 Hr. | 32 | |||||||||
Java Code Review 10
This challenge covers the review of a simple codebase in Java
|
< 1 Hr. | 38 | |||||||||
CVE-2023-4X25X
This challenge covers the review of a CVE in a Java codebase and its patch
|
-- | 36 | |||||||||
Puzzle 04 | 2-4 Hr. | 6 | |||||||||
CVE-2023-5X38X
This challenge covers the review of a CVE in a Java codebase and its patch
|
-- | 54 | |||||||||
CVE-2024-2X31X
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 60 | |||||||||
CVE-2024-X875X
This challenge covers the review of a CVE in a Java codebase and its patch
|
-- | 66 | |||||||||
CVE-2022-0415 | 2-4 Hr. | 9 | |||||||||
Java Code Review 07
This challenge covers the review of a simple codebase in Java
|
< 1 Hr. | 42 | |||||||||
Java Code Review 08
This challenge covers the review of a simple codebase in Java
|
< 1 Hr. | 45 | |||||||||
Java Code Review 09
This challenge covers the review of a simple codebase in Java
|
< 1 Hr. | 33 | |||||||||
Puzzle 01 | < 1 Hr. | 20 | |||||||||
Puzzle 02 | < 1 Hr. | 21 | |||||||||
API 13
This exercise covers a complex filter bypass in API.
|
< 1 Hr. | 232 | |||||||||
API 14
This exercise covers how to exploit a leaked encrypted password with an API.
|
< 1 Hr. | 250 | |||||||||
API 15
This exercise covers how to exploit a leaked encrypted password with an API.
|
1-2 Hr. | 205 | |||||||||
Java Code Review 04
This challenge covers the review of a simple codebase in Java
|
< 1 Hr. | 52 | |||||||||
Java Code Review 05
This challenge covers the review of a simple codebase in Java
|
< 1 Hr. | 56 | |||||||||
Java Code Review 06
This challenge covers the review of a simple codebase in Java
|
< 1 Hr. | 56 | |||||||||
API 10
This exercise covers a common filter bypass in API.
|
< 1 Hr. | 304 | |||||||||
API 11
This exercise covers a common filter bypass in API.
|
< 1 Hr. | 285 | |||||||||
API 12
This exercise covers a common filter bypass in API.
|
< 1 Hr. | 259 | |||||||||
Java Code Review 01
This challenge covers the review of a simple codebase in Java
|
< 1 Hr. | 86 | |||||||||
Java Code Review 02
This challenge covers the review of a simple codebase in Java
|
< 1 Hr. | 85 | |||||||||
Java Code Review 03
This challenge covers the review of a simple codebase in Java
|
-- | 69 | |||||||||
JSON Web Token XV: CVE-2022-39227
jwt
This exercise covers the exploitation of polyglot token against python_jwt (CVE-2022-39227)
|
< 1 Hr. | 21 | |||||||||
CVE-2023-X48X9
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 69 | |||||||||
CVE-2009-387X
This challenge covers the review of a CVE in a Java codebase and its patch
|
1-2 Hr. | 112 | |||||||||
CVE-2023-5143X
This challenge covers the review of a CVE in a Java codebase and its patch
|
1-2 Hr. | 120 | |||||||||
GHSA-95XX
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 56 | |||||||||
CVE-2022-4x13x
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 55 | |||||||||
CVE-2023-46XX2
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 53 | |||||||||
Java Serialize 06
This exercise is one of our challenges to help you learn Java Serialisation exploitation
|
2-4 Hr. | 16 | |||||||||
API 09
This exercise covers how one can inspect HTTP responses to identify information leaks.
|
< 1 Hr. | 393 | |||||||||
Java Serialize 04
This exercise is one of our challenges to help you learn Java Serialisation exploitation
|
1-2 Hr. | 49 | |||||||||
Java Serialize 05
This exercise is one of our challenges to help you learn Java Serialisation exploitation
|
2-4 Hr. | 27 | |||||||||
Cache Poisoning 01
This exercise details how to exploit an application vulnerable to cache poisoning
|
< 1 Hr. | 73 | |||||||||
Cache Deception 02
This exercise details how to exploit an application vulnerable to cache deception
|
< 1 Hr. | 71 | |||||||||
CVE-2023-XXX83
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 64 | |||||||||
CVE-2023-289X6
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 53 | |||||||||
CVE-2023-350XX
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 58 | |||||||||
CVE-2022-XX910
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 56 | |||||||||
CVE-2022-342XX
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 56 | |||||||||
Cache Deception 01
This exercise details how to exploit an application vulnerable to cache deception
|
< 1 Hr. | 91 | |||||||||
CVE-2022-X50X6
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 62 | |||||||||
CVE-2023-25X4X
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 48 | |||||||||
CVE-202X-2561X
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 69 | |||||||||
CVE-2022-x0x08
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 90 | |||||||||
CVE-2022-4504x
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 112 | |||||||||
CVE-2022-X51X3
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 104 | |||||||||
CVE-2007-546X
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 67 | |||||||||
CVE-2011-XX61
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 68 | |||||||||
CVE-2006-6X6X
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 70 | |||||||||
Java Serialize 02
This exercise is one of our challenges to help you learn Java Serialisation exploitation
|
< 1 Hr. | 99 | |||||||||
Java Serialize 03
This exercise is one of our challenges to help you learn Java Serialisation exploitation
|
< 1 Hr. | 81 | |||||||||
CVE-2014-7X09
This challenge covers the review of a CVE in a Java codebase and its patch
|
1-2 Hr. | 132 | |||||||||
CVE-2020-9X8X
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 164 | |||||||||
CVE-2018-XX34
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 113 | |||||||||
CVE-2012-5XX3
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 80 | |||||||||
CVE-2022-X41X9
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 64 | |||||||||
CVE-2009-26X3
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 83 | |||||||||
CVE-2022-357X1
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 75 | |||||||||
CVE-2023-30XX1
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 93 | |||||||||
CVE-2023-2X8X1
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 94 | |||||||||
SAML: PySAML2 SSRF
This exercise covers the exploitation of a SSRF in PySAML2
|
< 1 Hr. | 42 | |||||||||
CVE-2022-378xx
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 280 | |||||||||
CVE-2022-x0x09
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 126 | |||||||||
CVE-2018-8x14
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 63 | |||||||||
JSON Web Token XIV: Algorithm Confusion with ECDSA
jwt
This exercise covers the exploitation of algorithm confusion when no public key is available with a ECDSA key
|
1-2 Hr. | 21 | |||||||||
CVE-2014-X80X
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 95 | |||||||||
CVE-2015-3XX0
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 78 | |||||||||
CVE-2022-458X1
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 108 | |||||||||
SAML: CVE-2021-21239
This exercise covers the exploitation of CVE-2021-21239 (PySAML2)
|
1-2 Hr. | 33 | |||||||||
CVE-2022-393XX
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 87 | |||||||||
CVE-2023-2XX60
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 86 | |||||||||
CVE-2023-2XX61
This challenge covers the review of a CVE in a Java codebase and its patch
|
< 1 Hr. | 93 | |||||||||
SAML: Malicious IDP
This exercise covers the creation of a malicious IDP to forge an assertion
|
2-4 Hr. | 16 | |||||||||
DOMPDF RCE IV
This exercise covers the automation of the exploitation of a vulnerability in the DOMPDF library
|
> 4 Hr. | 19 | |||||||||
SAML: Signature Wrapping III
This exercise covers the exploitation of a Signature Wrapping Issue in passport-saml (CVE-2022-39299)
|
1-2 Hr. | 60 | |||||||||
XSL Java
This exercise covers the exploitation of a Java application using XSL
|
< 1 Hr. | 93 | |||||||||
DOMPDF RCE III
This exercise covers the exploitation of a vulnerability in the DOMPDF library
|
2-4 Hr. | 39 | |||||||||
XSL PHP V
This exercise covers the exploitation of a PHP application using XSL
|
< 1 Hr. | 94 | |||||||||
API Payments 07
This exercise covers a way to manipulate a shopping cart to lower the total amount
|
< 1 Hr. | 658 | |||||||||
CVE-2021-22204: Exiftool RCE II
This exercise covers how you can gain code execution when an application uses exiftool on user-controlled files
|
< 1 Hr. | 64 | |||||||||
XSL PHP IV
This exercise covers the exploitation of a PHP application using XSL
|
2-4 Hr. | 122 | |||||||||
API Payments 06
This exercise covers a simple payments bypass.
|
< 1 Hr. | 690 | |||||||||
CVE-2022-39224
This exercise covers the exploitation of CVE-2022-39224
|
2-4 Hr. | 71 | |||||||||
XSL PHP III
This exercise covers the exploitation of a PHP application using XSL
|
< 1 Hr. | 146 | |||||||||
DOMPDF RCE II
This exercise covers the exploitation of a vulnerability in the DOMPDF library
|
2-4 Hr. | 55 | |||||||||
DOMPDF RCE
This exercise covers the exploitation of a vulnerability in the DOMPDF library
|
< 1 Hr. | 123 | |||||||||
API Payments 05
This exercise covers how to abuse a shopping cart allowing users to apply a voucher.
|
< 1 Hr. | 622 | |||||||||
XSL PHP II
This exercise covers the exploitation of a PHP application using XSL
|
< 1 Hr. | 203 | |||||||||
API Payments 04
This exercise covers how to abuse a shopping cart allowing users to apply a voucher..
|
< 1 Hr. | 865 | |||||||||
XSL PHP
This exercise covers the exploitation of a PHP application using XSL
|
< 1 Hr. | 234 | |||||||||
API Payments 03
This exercise covers a simple payments bypass.
|
< 1 Hr. | 975 | |||||||||
Code Review 18
This exercise is one of our challenges to help you learn how to review real source code
|
1-2 Hr. | 128 | |||||||||
CVE-2020-13xxx
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 357 | |||||||||
CVE-2008-5x8x
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 458 | |||||||||
CVE-2022-3x7x1
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 467 | |||||||||
Python Snippet #02
This challenge covers the review of a snippet of code written in Python
|
< 1 Hr. | 1357 | |||||||||
Java Snippet #10
This challenge covers the review of a snippet of code written in Java
|
< 1 Hr. | 990 | |||||||||
Java Snippet #11
This challenge covers the review of a snippet of code written in Java
|
< 1 Hr. | 876 | |||||||||
Java Snippet #12
This challenge covers the review of a snippet of code written in Java
|
< 1 Hr. | 837 | |||||||||
API Payments 02
This exercise covers a simple payments bypass.
|
< 1 Hr. | 1130 | |||||||||
GCM Nonce Reuse
This challenge covers the impact of nonce reuse on GCM
|
< 1 Hr. | 132 | |||||||||
CVE-2019-5x2x
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 317 | |||||||||
Java Snippet #07
This challenge covers the review of a snippet of code written in Java
|
< 1 Hr. | 1196 | |||||||||
Java Snippet #08
This challenge covers the review of a snippet of code written in Java
|
< 1 Hr. | 1237 | |||||||||
Java Snippet #09
This challenge covers the review of a snippet of code written in Java
|
< 1 Hr. | 868 | |||||||||
API Payments 01
API
This exercise covers a simple payments bypass.
|
< 1 Hr. | 1453 | |||||||||
CVE-2022-26xx9
This challenge covers a vulnerable snippet in a real Java application
|
< 1 Hr. | 328 | |||||||||
Python Snippet #07
This challenge covers the review of a snippet of code written in Python
|
< 1 Hr. | 1094 | |||||||||
Python Snippet #08
This challenge covers the review of a snippet of code written in Python
|
< 1 Hr. | 1070 | |||||||||
Python Snippet #09
This challenge covers the review of a snippet of code written in Python
|
< 1 Hr. | 1088 | |||||||||
Mongo IDOR
This challenge covers how to exploit an IDOR when Mongo IDs are used
|
< 1 Hr. | 825 | |||||||||
CVE-2008-5x8x_ii
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 329 | |||||||||
CVE-2005-2x8x
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 340 | |||||||||
Golang Snippet #01
This challenge covers the review of a snippet of code written in Golang
|
< 1 Hr. | 1179 | |||||||||
Java Snippet #06
This challenge covers the review of a snippet of code written in Java
|
< 1 Hr. | 862 | |||||||||
Python Snippet #06
This challenge covers the review of a snippet of code written in Python
|
< 1 Hr. | 1209 | |||||||||
CVE-2022-21449
jwt
This exercise covers the exploitation of CVE-2022-21449 against a Java Application relying on JWT
|
< 1 Hr. | 125 | |||||||||
CVE-2021-33564 Argument Injection in Ruby Dragonfly
This exercise covers how you can get arbitrary file read using CVE-2021-33564 against Refinery CMS
|
< 1 Hr. | 118 | |||||||||
CVE-2021-45xx9
This challenge covers a vulnerable snippet in a real Python application
|
< 1 Hr. | 468 | |||||||||
PHP Snippet #07
This challenge covers the review of a snippet of code written in PHP
|
< 1 Hr. | 1134 | |||||||||
PHP Snippet #08
This challenge covers the review of a snippet of code written in PHP
|
< 1 Hr. | 989 | |||||||||
PHP Snippet #09
This challenge covers the review of a snippet of code written in PHP
|
< 1 Hr. | 988 | |||||||||
Python Snippet #03
This challenge covers the review of a snippet of code written in Python
|
< 1 Hr. | 1202 | |||||||||
Python Snippet #04
This challenge covers the review of a snippet of code written in Python
|
< 1 Hr. | 1067 | |||||||||
Python Snippet #05
This challenge covers the review of a snippet of code written in Python
|
< 1 Hr. | 1116 | |||||||||
CVE-2021-39x3x
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 337 | |||||||||
CVE-2022-21724: JDBC RCE PostgreSQL
This challenge covers how to gain code execution by leveraging a JDBC connection string with PostgreSQL
|
< 1 Hr. | 132 | |||||||||
Java Snippet #04
This challenge covers the review of a snippet of code written in Java
|
< 1 Hr. | 1036 | |||||||||
Java Snippet #05
This challenge covers the review of a snippet of code written in Java
|
< 1 Hr. | 944 | |||||||||
Ox Remote Code Execution II
This exercise covers how you can gain code execution when an application is using Ox to deserialize data and is running on Ruby 2.7
|
2-4 Hr. | 25 | |||||||||
CVE-2009-3x8x
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 444 | |||||||||
HTTP 41
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2104 | |||||||||
HTTP 42
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2125 | |||||||||
HTTP 43
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2050 | |||||||||
CVE-2021-381xx
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 370 | |||||||||
H2 RCE
This challenge covers how to gain code execution by leveraging an H2 database in a Java application
|
< 1 Hr. | 95 | |||||||||
TypeScript Snippet #04
This challenge covers the review of a snippet of code written in TypeScript
|
< 1 Hr. | 740 | |||||||||
TypeScript Snippet #05
This challenge covers the review of a snippet of code written in TypeScript
|
< 1 Hr. | 766 | |||||||||
TypeScript Snippet #06
This challenge covers the review of a snippet of code written in TypeScript
|
< 1 Hr. | 662 | |||||||||
TypeScript Snippet #07
This challenge covers the review of a snippet of code written in TypeScript
|
< 1 Hr. | 617 | |||||||||
TypeScript Snippet #08
This challenge covers the review of a snippet of code written in TypeScript
|
< 1 Hr. | 668 | |||||||||
TypeScript Snippet #09
This challenge covers the review of a snippet of code written in TypeScript
|
< 1 Hr. | 701 | |||||||||
CVE-2008-4x9x
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 390 | |||||||||
Log4j RCE II
This exercise is one of our challenges to help you learn Java Serialisation exploitation
|
1-2 Hr. | 150 | |||||||||
Log4j RCE
This challenge covers the latest RCE in Log4j
|
1-2 Hr. | 275 | |||||||||
CVE-2021-4379x
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 460 | |||||||||
API 08
This exercise covers how one can inspect HTTP responses to identify information leaks.
|
< 1 Hr. | 1225 | |||||||||
JDBC RCE
This exercise is one of our challenges to help you learn Java Serialisation exploitation
|
2-4 Hr. | 51 | |||||||||
CVE-2008-1x3x
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 570 | |||||||||
Golang Snippet #12
This challenge covers the review of a snippet of code written in Golang
|
< 1 Hr. | 650 | |||||||||
TypeScript Snippet #01
This challenge covers the review of a snippet of code written in TypeScript
|
< 1 Hr. | 939 | |||||||||
TypeScript Snippet #02
This challenge covers the review of a snippet of code written in TypeScript
|
< 1 Hr. | 886 | |||||||||
TypeScript Snippet #03
This challenge covers the review of a snippet of code written in TypeScript
|
< 1 Hr. | 824 | |||||||||
API 07
API
Angular
This exercise covers how one can inspect JavaScript code to identify information leak.
|
< 1 Hr. | 1296 | |||||||||
CVE-2021-40438
This challenge covers how to trigger a Server-Side Request Forgery by leveraging CVE-2021-40438
|
< 1 Hr. | 290 | |||||||||
CVE-2021-41773
This challenge covers how to read arbitrary files by leveraging CVE-2021-41773
|
< 1 Hr. | 471 | |||||||||
CVE-2021-41773 II
This challenge covers how to gain code execution by leveraging CVE-2021-41773
|
1-2 Hr. | 164 | |||||||||
HTTP 36
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2300 | |||||||||
HTTP 37
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2277 | |||||||||
HTTP 38
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2316 | |||||||||
HTTP 39
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2302 | |||||||||
HTTP 40
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2315 | |||||||||
CVE-2006-4xxx
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 454 | |||||||||
CVE-2006-4xxx_ii
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 353 | |||||||||
PHP Snippet #04
This challenge covers the review of a snippet of code written in PHP
|
< 1 Hr. | 1271 | |||||||||
PHP Snippet #05
This challenge covers the review of a snippet of code written in PHP
|
< 1 Hr. | 1183 | |||||||||
PHP Snippet #06
This challenge covers the review of a snippet of code written in PHP
|
< 1 Hr. | 1257 | |||||||||
API 06
API
Angular
This exercise covers how one can inspect JavaScript code to identify unused endpoints.
|
< 1 Hr. | 1450 | |||||||||
CVE-2021-37xxx
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 410 | |||||||||
PHP Snippet #01
This challenge covers the review of a snippet of code written in PHP
|
< 1 Hr. | 1825 | |||||||||
PHP Snippet #02
This challenge covers the review of a snippet of code written in PHP
|
< 1 Hr. | 1562 | |||||||||
PHP Snippet #03
This challenge covers the review of a snippet of code written in PHP
|
< 1 Hr. | 1337 | |||||||||
HTTP 31
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2431 | |||||||||
HTTP 32
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2376 | |||||||||
HTTP 35
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2366 | |||||||||
HTTP 34
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2338 | |||||||||
HTTP 33
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2369 | |||||||||
API 05
API
Angular
This exercise covers how one can inspect JavaScript code to identify unused endpoints.
|
< 1 Hr. | 1725 | |||||||||
API 04
API
Angular
This exercise covers how one can inspect JavaScript code to identify unused endpoints.
|
< 1 Hr. | 1804 | |||||||||
Golang Snippet #02
This challenge covers the review of a snippet of code written in Golang
|
< 1 Hr. | 943 | |||||||||
Golang Snippet #03
This challenge covers the review of a snippet of code written in Golang
|
< 1 Hr. | 779 | |||||||||
Golang Snippet #04
This challenge covers the review of a snippet of code written in Golang
|
< 1 Hr. | 858 | |||||||||
Golang Snippet #05
This challenge covers the review of a snippet of code written in Golang
|
< 1 Hr. | 835 | |||||||||
Golang Snippet #06
This challenge covers the review of a snippet of code written in Golang
|
< 1 Hr. | 734 | |||||||||
Golang Snippet #07
This challenge covers the review of a snippet of code written in Golang
|
< 1 Hr. | 763 | |||||||||
Golang Snippet #08
This challenge covers the review of a snippet of code written in Golang
|
< 1 Hr. | 707 | |||||||||
Golang Snippet #09
This challenge covers the review of a snippet of code written in Golang
|
< 1 Hr. | 662 | |||||||||
Golang Snippet #10
This challenge covers the review of a snippet of code written in Golang
|
< 1 Hr. | 749 | |||||||||
Golang Snippet #11
This challenge covers the review of a snippet of code written in Golang
|
< 1 Hr. | 737 | |||||||||
Javascript Snippet #01
This challenge covers the review of a snippet of code written in JavaScript
|
< 1 Hr. | 1550 | |||||||||
Javascript Snippet #02
This challenge covers the review of a snippet of code written in JavaScript
|
< 1 Hr. | 1245 | |||||||||
Javascript Snippet #03
This challenge covers the review of a snippet of code written in JavaScript
|
< 1 Hr. | 1267 | |||||||||
Javascript Snippet #04
This challenge covers the review of a snippet of code written in JavaScript
|
< 1 Hr. | 1172 | |||||||||
Javascript Snippet #05
This challenge covers the review of a snippet of code written in JavaScript
|
< 1 Hr. | 1226 | |||||||||
Javascript Snippet #06
This challenge covers the review of a snippet of code written in JavaScript
|
< 1 Hr. | 1115 | |||||||||
Javascript Snippet #07
This challenge covers the review of a snippet of code written in JavaScript
|
< 1 Hr. | 1094 | |||||||||
Python Snippet #01
This challenge covers the review of a snippet of code written in Python
|
< 1 Hr. | 1481 | |||||||||
Ruby Snippet #01
This challenge covers the review of a snippet of code written in Ruby
|
< 1 Hr. | 576 | |||||||||
Ruby Snippet #02
This challenge covers the review of a snippet of code written in Ruby
|
< 1 Hr. | 549 | |||||||||
Ruby Snippet #03
This challenge covers the review of a snippet of code written in Ruby
|
< 1 Hr. | 577 | |||||||||
Ruby Snippet #04
This challenge covers the review of a snippet of code written in Ruby
|
< 1 Hr. | 519 | |||||||||
Ruby Snippet #05
This challenge covers the review of a snippet of code written in Ruby
|
< 1 Hr. | 594 | |||||||||
Ruby Snippet #06
This challenge covers the review of a snippet of code written in Ruby
|
< 1 Hr. | 575 | |||||||||
Ruby Snippet #07
This challenge covers the review of a snippet of code written in Ruby
|
< 1 Hr. | 456 | |||||||||
Ruby Snippet #08
This challenge covers the review of a snippet of code written in Ruby
|
< 1 Hr. | 498 | |||||||||
Ruby Snippet #09
This challenge covers the review of a snippet of code written in Ruby
|
< 1 Hr. | 460 | |||||||||
HTTP 26
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2615 | |||||||||
HTTP 27
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2551 | |||||||||
HTTP 28
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2543 | |||||||||
HTTP 29
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2466 | |||||||||
HTTP 30
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2512 | |||||||||
CVE-2020-17xx7
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 751 | |||||||||
Ox Remote Code Execution
This exercise covers how you can gain code execution when an application is using Ox to deserialize data and is running on Ruby 2.3
|
2-4 Hr. | 64 | |||||||||
CVE-2020-9x9x
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 592 | |||||||||
HTTP 21
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2750 | |||||||||
HTTP 22
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2718 | |||||||||
HTTP 23
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2649 | |||||||||
HTTP 24
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2646 | |||||||||
HTTP 25
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2670 | |||||||||
HTTP 16
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2849 | |||||||||
HTTP 20
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2760 | |||||||||
HTTP 18
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2815 | |||||||||
HTTP 19
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2800 | |||||||||
HTTP 17
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2829 | |||||||||
CVE-2020-17xx8
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 436 | |||||||||
CVE-2021-22204: Exiftool RCE
This exercise covers how you can gain code execution when an application uses exiftool on user-controlled files
|
1-2 Hr. | 158 | |||||||||
SSRF via FFMPEG II
This exercise covers how you can read arbitrary files when an application uses ffmpeg to render videos from a video you provide
|
< 1 Hr. | 110 | |||||||||
API 03
API
This exercise is the API version of an exercise you already solved in another badge. You should use it to get more confident with discovering vulnerabilities without any hint on what to look for.
|
< 1 Hr. | 1851 | |||||||||
CVE-2020-11xxx
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 448 | |||||||||
OAuth2: Authorization Server XSS II
This exercise covers the exploitation of an XSS in an OAuth2 Authorization Server
|
< 1 Hr. | 239 | |||||||||
HTTP 11
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 3077 | |||||||||
HTTP 15
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2954 | |||||||||
HTTP 12
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 3036 | |||||||||
HTTP 13
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2965 | |||||||||
HTTP 14
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 2971 | |||||||||
API 02
API
This exercise is the API version of an exercise you already solved in another badge. You should use it to get more confident with discovering vulnerabilities without any hint on what to look for.
|
< 1 Hr. | 2403 | |||||||||
Express Local File Read
This exercise covers how an insecure call to render can be used to gain local files read with Express
|
< 1 Hr. | 350 | |||||||||
OAuth2: Authorization Server XSS
This exercise covers the exploitation of an XSS in an OAuth2 Authorization Server
|
< 1 Hr. | 316 | |||||||||
HTTP 10
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 3153 | |||||||||
HTTP 09
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 3240 | |||||||||
HTTP 07
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 3325 | |||||||||
HTTP 06
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 3397 | |||||||||
HTTP 08
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 3246 | |||||||||
HTTP 03
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 3697 | |||||||||
HTTP 04
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 3564 | |||||||||
HTTP 05
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 3498 | |||||||||
HTTP 02
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 3893 | |||||||||
HTTP 01
This challenge covers how to send specific HTTP requests
|
< 1 Hr. | 4110 | |||||||||
API 01
API
This exercise is the API version of an exercise you already solved in the Essential Badge. You should use it to get more confident with discovering vulnerabilities without any hint on what to look for.
|
< 1 Hr. | 2882 | |||||||||
JSON Web Token XIII
jwt
This exercise covers the exploitation of algorithm confusion when no public key is available
|
< 1 Hr. | 153 | |||||||||
SAML: Comment Injection II
This exercise covers the exploitation of a comment injection vulnerability in SAML
|
< 1 Hr. | 501 | |||||||||
Recon 24
In this challenge, you need to look for a file named key.txt in the place used to serve the assets for the main website
|
< 1 Hr. | 3860 | |||||||||
Recon 25
In this challenge, you need to look for a file named key2.txt in the place used to serve the assets for the main website
|
1-2 Hr. | 2374 | |||||||||
Recon 26
In this challenge, you need to look for a key in the JavaScript used by the website
|
< 1 Hr. | 3701 | |||||||||
SSRF via FFMPEG
This exercise covers how you can read arbitrary files when an application uses ffmpeg to render videos from a video you provide
|
< 1 Hr. | 221 | |||||||||
SAML: Signature Wrapping II
This exercise covers how to use Signature Wrapping to become an arbitrary user
|
< 1 Hr. | 376 | |||||||||
RCE via argument injection
This exercise covers a remote command execution vulnerability via argument injection
|
> 4 Hr. | 41 | |||||||||
Code Review 16
This exercise is one of our challenges to help you learn how to review real source code
|
< 1 Hr. | 240 | |||||||||
SAML: Signature Wrapping
This exercise covers how to use Signature Wrapping to become an arbitrary user
|
< 1 Hr. | 469 | |||||||||
Recon 20
In this challenge, you need to look at the branches in repo3
|
< 1 Hr. | 3956 | |||||||||
Recon 21
In this challenge, you need to look at the information in the branches for repo4
|
< 1 Hr. | 3863 | |||||||||
Recon 22
In this challenge, you need to look in repo9 for deleted files
|
< 1 Hr. | 3694 | |||||||||
Recon 23
In this challenge, you need to look for sensitive information in commit messages
|
< 1 Hr. | 3698 | |||||||||
SAML: SAMLResponse forwarding
This exercise covers how to pass the SAMLResponse from one Service Provider to another
|
< 1 Hr. | 428 | |||||||||
CGI and Signature
This exercise covers the exploitation of a vulnerable CGI.
|
< 1 Hr. | 192 | |||||||||
Recon 17
In this challenge, you need to look at the name of the developer used in the repository test1
|
< 1 Hr. | 4235 | |||||||||
Recon 18
In this challenge, you need to look at the public repository of the developers in the organisation
|
< 1 Hr. | 3996 | |||||||||
Recon 19
In this challenge, you need to look at the email addresses used for commits in the repository repo7
|
< 1 Hr. | 3731 | |||||||||
Code Review 15
This exercise is one of our challenges to help you learn how to review real source code
|
< 1 Hr. | 236 | |||||||||
Code Review 14
This exercise is one of our challenges to help you learn how to review real source code
|
< 1 Hr. | 256 | |||||||||
CVE-2020-14343: PyYAML unsafe loader
This exercise covers how you can gain code execution when an application use a vulnerable version of PyYAML and relies on load()
|
< 1 Hr. | 277 | |||||||||
OAuth2: State Fixation
This exercise covers the exploitation of a state fixation in an OAuth2 Client
|
1-2 Hr. | 355 | |||||||||
Code Review 13
This exercise is one of our challenges to help you learn how to review real source code
|
2-4 Hr. | 163 | |||||||||
CVE-2020-7115: Aruba Clearpass RCE
This exercise covers a remote command execution issue on Aruba Clearpass RCE
|
< 1 Hr. | 183 | |||||||||
Code Review 12
This exercise is one of our challenges to help you learn how to review real source code
|
< 1 Hr. | 284 | |||||||||
OAuth2: Predictable State II
This exercise covers the exploitation of a predictable state in an OAuth2 Client
|
1-2 Hr. | 239 | |||||||||
Recon 13
In this challenge, you need to find the TXT record linked to key.z.hackycorp.com
|
< 1 Hr. | 4987 | |||||||||
Recon 14
In this challenge, you need to find a TXT record by doing a zone transfer on z.hackycorp.com
|
< 1 Hr. | 4486 | |||||||||
Recon 15
In this challenge, you need to find a TXT record by doing a zone transfer on the internal zone "int"
|
< 1 Hr. | 3981 | |||||||||
Recon 16
In this challenge, you need to find the version of Bind used
|
< 1 Hr. | 4172 | |||||||||
EDDSA vulnerability in Monocypher
crypto
This exercise covers the exploitation of a vulnerability impacting Monocypher.
|
1-2 Hr. | 148 | |||||||||
Code Review 11
This exercise is one of our challenges to help you learn how to review real source code
|
2-4 Hr. | 117 | |||||||||
OAuth2: Predictable State
This exercise covers the exploitation of a predictable state in an OAuth2 Client
|
2-4 Hr. | 260 | |||||||||
Code Review 10
This exercise is one of our challenges to help you learn how to review real source code
|
< 1 Hr. | 224 | |||||||||
Recon 11 | < 1 Hr. | 4490 | |||||||||
Recon 12 | < 1 Hr. | 4982 | |||||||||
Unicode and NFKC
This exercise covers how to leverage unicode to exploit a directory traversal
|
< 1 Hr. | 270 | |||||||||
SAML: Trusted Embedded Key
This exercise covers the exploitation of a Service Provider (SP) that doesn't check the certificate provided in the SAMLResponse
|
< 1 Hr. | 442 | |||||||||
Recon 06
This exercise covers default vhost
|
< 1 Hr. | 8918 | |||||||||
Recon 07
This exercise covers default TLS vhost
|
< 1 Hr. | 8029 | |||||||||
Recon 08
This exercise covers aliases in TLS certificates
|
< 1 Hr. | 7251 | |||||||||
CVE-2020-8163: Rails local name RCE
This exercise details the exploitation of CVE-2020-8163 to gain code execution
|
1-2 Hr. | 204 | |||||||||
SAML: Known Key
This exercise covers the exploitation of a known key in SAML
|
1-2 Hr. | 466 | |||||||||
Code Review 09
This exercise is one of our challenges to help you learn how to review real source code
|
1-2 Hr. | 165 | |||||||||
Recon 04
This exercise covers common interesting directories
|
< 1 Hr. | 12270 | |||||||||
Recon 05
This exercise covers simple directory bruteforcing
|
< 1 Hr. | 9100 | |||||||||
Recon 01
This exercise covers 404 error pages
|
< 1 Hr. | 16301 | |||||||||
OAuth2: Client Server XSS
This exercise covers the exploitation of a Cross-Site Scripting in an OAuth2 Client and Server
|
1-2 Hr. | 332 | |||||||||
Zip symlink
This exercise covers how you can create a malicious Zip file and use it to gain access to sensitive files.
|
< 1 Hr. | 534 | |||||||||
Code Review 08
This exercise is one of our challenges to help you learn how to review real source code
|
1-2 Hr. | 243 | |||||||||
SAML: Comment Injection
This exercise covers the exploitation of a comment injection vulnerability in SAML
|
< 1 Hr. | 1433 | |||||||||
Unicode and Downcase
This exercise covers how you can use unicode to gain access to an admin account.
|
< 1 Hr. | 550 | |||||||||
Code Review 07
This exercise is one of our challenges to help you learn how to review real source code
|
1-2 Hr. | 194 | |||||||||
Java Serialize 01
This exercise is one of our challenges to help you learn Java Serialisation exploitation
|
< 1 Hr. | 345 | |||||||||
Unicode and Uppercase
This exercise covers how you can use unicode to gain access to an admin account.
|
< 1 Hr. | 613 | |||||||||
Code Review 06
This exercise is one of our challenges to help you learn how to review real source code
|
2-4 Hr. | 129 | |||||||||
Cross-Site Leak
This exercise covers how to use Cross-Site Leak to recover sensitive information
|
2-4 Hr. | 527 | |||||||||
From SQL injection to Shell III: PostgreSQL Edition
SQL Injection
This exercise covers how to gain access to an administration interface using a SQL injection, and how to get command execution using Ghostscript
|
2-4 Hr. | 208 | |||||||||
OAuth2: Client CSRF II
This exercise covers the exploitation of a CSRF in an OAuth2 Client
|
2-4 Hr. | 452 | |||||||||
XSS Include
XSS
This exercise covers how to use Cross-Site-Scripting Include to leak information
|
< 1 Hr. | 1198 | |||||||||
OAuth2: Client CSRF
This exercise covers the exploitation of a CSRF in an OAuth2 Client
|
< 1 Hr. | 895 | |||||||||
Code Review 05
This exercise is one of our challenges to help you learn how to review real source code
|
2-4 Hr. | 162 | |||||||||
Code Review 04
This exercise is one of our challenges to help you learn how to review real source code
|
1-2 Hr. | 272 | |||||||||
JS Prototype Pollution
This exercise covers how to exploit Prototype Pollution against a JavaScript application
|
< 1 Hr. | 827 | |||||||||
OAuth2: Authorization Server CSRF
This exercise covers the exploitation of a CSRF in an OAuth2 Authorization Server
|
1-2 Hr. | 1033 | |||||||||
Code Review 03
This exercise is one of our challenges to help you learn how to review real source code
|
2-4 Hr. | 185 | |||||||||
SSRF in PDF generation
This exercise covers how you can read arbitrary files when an application generates pdfs from provided links
|
< 1 Hr. | 812 | |||||||||
OAuth2: Github HTTP HEAD
This exercise covers the exploitation of the HTTP HEAD issue impacting Github in 2019
|
< 1 Hr. | 424 | |||||||||
SVG XSS
This exercise covers how to use an SVG to trigger a Cross-Site-Scripting
|
< 1 Hr. | 1644 | |||||||||
Apache Pluto RCE
This exercise covers how to gain code execution on Apache Pluto 3.0.0 due to a flaw in the authorization logic
|
< 1 Hr. | 493 | |||||||||
JSON Cross-Site Request Forgery
This exercise details the exploitation of a Cross-Site Request Forgery when JSON is used
|
< 1 Hr. | 1356 | |||||||||
Cross-Site Request Forgery
This exercise details the exploitation of a Cross-Site Request Forgery to gain access to sensitive data
|
< 1 Hr. | 1438 | |||||||||
Code Review 02
This exercise is one of our challenges to help you learn how to review real source code
|
1-2 Hr. | 335 | |||||||||
postMessage() IV
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the Origin and X-Frame-Options is used
|
< 1 Hr. | 877 | |||||||||
Spring Actuators
This exercise covers how you can gain code execution using Spring Actuators when Spring Cloud is used.
|
1-2 Hr. | 263 | |||||||||
postMessage() III
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to trigger a Cross-Site Scripting
|
< 1 Hr. | 889 | |||||||||
postMessage() II
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the Origin
|
< 1 Hr. | 988 | |||||||||
PHP phar://
This exercise covers how the PHP phar:// handler can be used to gain code execution using PHP unserialize.
|
< 1 Hr. | 322 | |||||||||
Signing Oracle
This exercise covers how a signing oracle can be used to bypass authorization in place
|
< 1 Hr. | 751 | |||||||||
Length Extension Attack
This exercise covers how to use a length extension attack to exploit a directory traversal vulnerability
|
1-2 Hr. | 674 | |||||||||
JSON Web Encryption
This exercise covers how you can create your own JWE if you have access to the public key used by the server
|
< 1 Hr. | 483 | |||||||||
postMessage()
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information
|
< 1 Hr. | 1122 | |||||||||
CVE-2019-5418
This exercise details the exploitation of CVE-2019-5418 to get code execution
|
1-2 Hr. | 451 | |||||||||
Cross-Site WebSocket Hijacking
This exercise covers Cross-Site WebSocket Hijacking and how it can be used to gain access to sensitive information
|
< 1 Hr. | 1013 | |||||||||
JWT XII
jwt
This exercise covers how to use the x5u header to bypass an authentication based on JWT.
|
1-2 Hr. | 618 | |||||||||
Cross-Origin Resource Sharing II
This exercise covers Cross-Origin Resource Sharing and how it can be used to get access to sensitive data.
|
< 1 Hr. | 957 | |||||||||
JWT XI
jwt
This exercise covers how to use the jku header to bypass an authentication based on JWT.
|
1-2 Hr. | 613 | |||||||||
cve-2019-5420 II
This exercise details the exploitation of CVE-2019-5420 to gain code execution
|
1-2 Hr. | 509 | |||||||||
OAuth2: Client OpenRedirect
This exercise covers the exploitation of an OpenRedirect in an OAuth2 Client
|
< 1 Hr. | 775 | |||||||||
CVE-2019-5420
This exercise details the exploitation of CVE-2019-5420 to forge a session as another user
|
2-4 Hr. | 802 | |||||||||
JWT X
jwt
This exercise covers how to use the jku header to bypass an authentication based on JWT.
|
< 1 Hr. | 696 | |||||||||
GraphQL: SQL Injection
This exercise covers how to use introspection and a SQL injection to get access to additional information in GraphQL.
|
1-2 Hr. | 1298 | |||||||||
OAuth2: Authorization Server OpenRedirect
This exercise covers the exploitation of an OpenRedirect in an OAuth2 Authorization Server
|
< 1 Hr. | 888 | |||||||||
JWT IX
jwt
This exercise covers how to use the jku header to bypass an authentication based on JWT.
|
< 1 Hr. | 811 | |||||||||
Gogs RCE II
This exercise covers how to get code execution against the Git self hosted tool: Gogs.
|
< 1 Hr. | 544 | |||||||||
JWT VIII
jwt
This exercise covers how to use the jku header to bypass an authentication based on JWT.
|
1-2 Hr. | 878 | |||||||||
SAML: Signature Stripping
This exercise covers the exploitation of a signature stripping vulnerability in SAML
|
< 1 Hr. | 1799 | |||||||||
GraphQL Introspection
This exercise covers how to use introspection to get access to additional information in GraphQL.
|
< 1 Hr. | 2114 | |||||||||
Gogs RCE
This exercise covers how to get code execution against the Git self hosted tool: Gogs.
|
1-2 Hr. | 608 | |||||||||
Android 07
This exercise will guide you through the process of reversing a simple obfuscated Android code to recover the encrypted data
|
1-2 Hr. | 1282 | |||||||||
Android 06
This exercise will guide you through the process of reversing a simple obfuscated Android code to recover the encrypted data
|
< 1 Hr. | 1503 | |||||||||
Android 05
This exercise will guide you through the process of reversing a simple obfuscated Android code to recover the encrypted data
|
1-2 Hr. | 1779 | |||||||||
Ruby 2.x Universal RCE Deserialization Gadget Chain
This exercise covers how to get code execution by using a Ruby Universal Gadget when an attacker controls the data passed to Marshal.load()
|
< 1 Hr. | 1290 | |||||||||
CVE-2018-10933: LibSSH auth bypass
This exercise covers how to bypass authentication on an SSH server based on libssh to gain a shell on the affected system
|
-- | 0 | |||||||||
Android 04
This exercise will guide you through the process of reversing a simple Android code
|
< 1 Hr. | 2273 | |||||||||
Android 03
This exercise will guide you through the process of extracting simple information from an APK
|
< 1 Hr. | 3048 | |||||||||
From SQL injection to Shell III
SQL Injection
This exercise covers how to gain access to an administration interface using SQL injection followed by how to get command execution using ImageTragick
|
1-2 Hr. | 1015 | |||||||||
Android 02
This exercise will guide you through the process of extracting data from a simple database used by an Android app
|
< 1 Hr. | 3317 | |||||||||
IDOR to Shell
This exercise covers how to get code execution by chaining vulnerabilities in a Ruby-on-Rails application
|
1-2 Hr. | 952 | |||||||||
Android 01
This exercise will guide you through the process of extracting simple information from an APK
|
< 1 Hr. | 3544 | |||||||||
Introduction to CSP
This exercise details the exploitation of a XSS in a simple web application that uses Content Security Policy
|
< 1 Hr. | 2296 | |||||||||
CVE-2018-11235: Git Submodule RCE
This exercise details the exploitation of a vulnerability in Git Sub
module that can be used to get command execution
|
2-4 Hr. | 475 | |||||||||
Git Information Leak II
This exercise details how to retrieve information from an exposed .git directory on a web server, provided directory listing is disabled
|
< 1 Hr. | 2409 | |||||||||
Git Information Leak
This exercise details how to retrieve information from an exposed .git directory on a web server
|
< 1 Hr. | 3198 | |||||||||
JWT VII
jwt
This exercise covers the exploitation of a website using JWT for session without verifying the signature
|
< 1 Hr. | 3095 | |||||||||
CVE-2016-5386: HTTPoxy/Golang HTTProxy namespace conflict
This exercise covers the exploitation of HTTPoxy against an old version of Golang
|
< 1 Hr. | 852 | |||||||||
Unix 31
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 13306 | |||||||||
Unix 30
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 13334 | |||||||||
Unix 25
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 13980 | |||||||||
Unix 32
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 13282 | |||||||||
Unix 34
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 13217 | |||||||||
Unix 33
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 13254 | |||||||||
Unix 27
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 13805 | |||||||||
Unix 29
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 13731 | |||||||||
Unix 28
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 13753 | |||||||||
Unix 26
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 13891 | |||||||||
CBC-MAC II
crypto
This exercise covers the exploitation of an application using CBC-MAC when an attacker has control over the IV
|
1-2 Hr. | 1612 | |||||||||
JWT VI
jwt
This exercise covers the exploitation of an injection in the kid element of a JWT. This injection can be used to bypass the signature mechanism
|
< 1 Hr. | 2366 | |||||||||
CVE-2018-6574: go get RCE
This exercise covers a remote command execution in Golang's go get command.
|
< 1 Hr. | 818 | |||||||||
Unix 11
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 18724 | |||||||||
Unix 12
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 18216 | |||||||||
Unix 13
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 17390 | |||||||||
Unix 14
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 16959 | |||||||||
Unix 15
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 15465 | |||||||||
Unix 16
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 15113 | |||||||||
Unix 17
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 15339 | |||||||||
Unix 18
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 15268 | |||||||||
Unix 19
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 15180 | |||||||||
Unix 20
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 14238 | |||||||||
Unix 21
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 14421 | |||||||||
Unix 22
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 14289 | |||||||||
Unix 23
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 14064 | |||||||||
Unix 24
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 13983 | |||||||||
JWT V
jwt
This exercise covers the exploitation of a trivial secret used to sign JWT tokens.
|
< 1 Hr. | 2820 | |||||||||
CVE-2018-0114
jwt
This exercise details
the exploitation of a vulnerability in Cisco's node-jose, a JavaScript library created to manage JWT
|
2-4 Hr. | 1722 | |||||||||
JWT IV
jwt
This exercise covers the exploitation of a vulnerability similar to the recent CVE-2017-17405 impacting Ruby Net::FTP
|
< 1 Hr. | 2507 | |||||||||
CBC-MAC
crypto
This exercise covers the exploitation of signature of non-fixed size messages with CBC-MAC
|
1-2 Hr. | 1575 | |||||||||
JWT III
jwt
This exercise covers the exploitation of an issue in the usage of JWT token
|
1-2 Hr. | 2696 | |||||||||
Code Execution 09
This exercise is one of our challenges on Code Execution
|
< 1 Hr. | 10176 | |||||||||
Server Side Template Injection 02
This exercise is one of our challenges on Server-Side Template Injection
|
< 1 Hr. | 7989 | |||||||||
MongoDB Injection 02
This exercise is one of our challenges on vulnerabilities related to MongoDB
|
1-2 Hr. | 8004 | |||||||||
Authorization 06
This exercise is one of our challenges on Authorisation issues
|
< 1 Hr. | 13912 | |||||||||
Code Execution 08
This exercise is one of our challenges on Code Execution
|
< 1 Hr. | 10274 | |||||||||
Authorization 04
This exercise is one of our challenges on Authorisation issues
|
< 1 Hr. | 15019 | |||||||||
Authorization 05
This exercise is one of our challenges on Authorisation issues
|
< 1 Hr. | 14490 | |||||||||
Command Execution 03
This exercise is one of our challenges on Command Execution
|
< 1 Hr. | 10606 | |||||||||
Server Side Template Injection 01
This exercise is one of our challenges on Server-Side Template Injection
|
< 1 Hr. | 7981 | |||||||||
Code Execution 05
This exercise is one of our challenges on Code Execution
|
< 1 Hr. | 11725 | |||||||||
Code Execution 06
This exercise is one of our challenges on Code Execution
|
< 1 Hr. | 11469 | |||||||||
Code Execution 07
This exercise is one of our challenges on Code Execution
|
< 1 Hr. | 11228 | |||||||||
Introduction to code review
This exercise covers the different ways to perform code review. It also contains a simple application to review to help you get started.
|
-- | 0 | |||||||||
S2-052
This exercise covers the exploitation of the Struts S2-052 vulnerability
|
< 1 Hr. | 2388 | |||||||||
SQL Injection 06
SQL Injection
This exercise is one of our challenges on SQL Injections
|
< 1 Hr. | 8768 | |||||||||
XML Attacks 01
This exercise is one of our challenges on vulnerabilities related to XML processing
|
< 1 Hr. | 8483 | |||||||||
XML Attacks 02
This exercise is one of our challenges on vulnerabilities related to XML processing
|
< 1 Hr. | 8025 | |||||||||
SQL Injection 04
SQL Injection
This exercise is one of our challenges on SQL Injections
|
< 1 Hr. | 9296 | |||||||||
SQL Injection 05
SQL Injection
This exercise is one of our challenges on SQL Injections
|
< 1 Hr. | 9212 | |||||||||
SQL Injection 01
SQL Injection
This exercise is one of our challenges on SQL Injections
|
< 1 Hr. | 10363 | |||||||||
SQL Injection 02
SQL Injection
This exercise is one of our challenges on SQL Injections
|
< 1 Hr. | 10021 | |||||||||
SQL Injection 03
SQL Injection
This exercise is one of our challenges on SQL Injections
|
< 1 Hr. | 9736 | |||||||||
Code Execution 02
This exercise is one of our challenges on Code Execution
|
< 1 Hr. | 12989 | |||||||||
Authorization 03
This exercise is one of our challenges on Authorisation issues
|
< 1 Hr. | 15980 | |||||||||
Command Execution 01
This exercise is one of our challenges on Command Execution
|
< 1 Hr. | 11069 | |||||||||
Command Execution 02
This exercise is one of our challenges on Command Execution
|
< 1 Hr. | 10727 | |||||||||
Server Side Request Forgery 04
This exercise is one of our challenges on Server-Side Request Forgery
|
< 1 Hr. | 9099 | |||||||||
Open Redirect 01
This exercise is one of our challenges on Open Redirect
|
< 1 Hr. | 9406 | |||||||||
Open Redirect 02
This exercise is one of our challenges on Open Redirect
|
< 1 Hr. | 9102 | |||||||||
MongoDB Injection 01
This exercise is one of our challenges on vulnerabilities related to MongoDB
|
< 1 Hr. | 9507 | |||||||||
SAML: Introduction
This exercise covers the exploitation of a signature stripping vulnerability in SAML
|
< 1 Hr. | 2484 | |||||||||
Server Side Request Forgery 02
This exercise is one of our challenges on Server-Side Request Forgery
|
< 1 Hr. | 9444 | |||||||||
Server Side Request Forgery 03
This exercise is one of our challenges on Server-Side Request Forgery
|
< 1 Hr. | 9407 | |||||||||
Server Side Request Forgery 01
This exercise is one of our challenges on Server-Side Request Forgery
|
< 1 Hr. | 9620 | |||||||||
XSS 09
XSS
This exercise is one of our challenges on Cross-Site Scripting
|
< 1 Hr. | 8534 | |||||||||
XSS 10
XSS
This exercise is one of our challenges on Cross-Site Scripting
|
< 1 Hr. | 7911 | |||||||||
Directory Traversal 01
This exercise is one of our challenges on Directory Traversal
|
< 1 Hr. | 11295 | |||||||||
Directory Traversal 02
This exercise is one of our challenges on Directory Traversal
|
< 1 Hr. | 11082 | |||||||||
Directory Traversal 03
This exercise is one of our challenges on Directory Traversal
|
< 1 Hr. | 10942 | |||||||||
XSS 02
XSS
This exercise is one of our challenges on Cross-Site Scripting
|
< 1 Hr. | 10083 | |||||||||
XSS 03
XSS
This exercise is one of our challenges on Cross-Site Scripting
|
< 1 Hr. | 9717 | |||||||||
XSS 04
XSS
This exercise is one of our challenges on Cross-Site Scripting
|
< 1 Hr. | 9240 | |||||||||
XSS 05
XSS
This exercise is one of our challenges on Cross-Site Scripting
|
< 1 Hr. | 8958 | |||||||||
XSS 06
XSS
This exercise is one of our challenges on Cross-Site Scripting
|
< 1 Hr. | 8913 | |||||||||
XSS 07
XSS
This exercise is one of our challenges on Cross-Site Scripting
|
< 1 Hr. | 8763 | |||||||||
XSS 08
XSS
This exercise is one of our challenges on Cross-Site Scripting
|
< 1 Hr. | 8634 | |||||||||
File Upload 01
This exercise is one of our challenges on Upload vulnerabilities
|
< 1 Hr. | 8733 | |||||||||
File Upload 02
This exercise is one of our challenges on Upload vulnerabilities
|
< 1 Hr. | 8617 | |||||||||
XSS 01
XSS
This exercise is one of our challenges on Cross-Site Scripting
|
< 1 Hr. | 10494 | |||||||||
Authentication 05
This exercise is one of our challenges on Authentication issues
|
< 1 Hr. | 16383 | |||||||||
Code Execution 03
This exercise is one of our challenges on Code Execution
|
< 1 Hr. | 12339 | |||||||||
Code Execution 04
This exercise is one of our challenges on Code Execution
|
< 1 Hr. | 12104 | |||||||||
File Include 01
This exercise is one of our challenges on File Include vulnerabilities
|
< 1 Hr. | 10437 | |||||||||
File Include 02
This exercise is one of our challenges on File Include vulnerabilities
|
< 1 Hr. | 10171 | |||||||||
LDAP 01
This exercise is one of our challenges on vulnerabilities related to LDAP
|
< 1 Hr. | 10110 | |||||||||
LDAP 02
This exercise is one of our challenges on vulnerabilities related to LDAP
|
< 1 Hr. | 9662 | |||||||||
Authentication 04
This exercise is one of our challenges on Authentication issues
|
< 1 Hr. | 17136 | |||||||||
Authentication 01
This exercise is one of our challenges on Authentication issues
|
< 1 Hr. | 18622 | |||||||||
Authentication 02
This exercise is one of our challenges on Authentication issues
|
< 1 Hr. | 17982 | |||||||||
Authentication 03
This exercise is one of our challenges on Authentication issues
|
< 1 Hr. | 17459 | |||||||||
Authorization 01
This exercise is one of our challenges on Authorisation issues
|
< 1 Hr. | 16529 | |||||||||
Authorization 02
This exercise is one of our challenges on Authorisation issues
|
< 1 Hr. | 16222 | |||||||||
Code Execution 01
This exercise is one of our challenges on Code Execution
|
< 1 Hr. | 13801 | |||||||||
CVE-2016-10033: PHPMailer RCE
This exercise covers a remote code execution vulnerability in PHPMailer
|
< 1 Hr. | 3540 | |||||||||
Cipher block chaining
crypto
This exercise details how to tamper with data encrypted using CBC
|
1-2 Hr. | 2756 | |||||||||
Struts s2-045
This exercise covers a Remote Code Execution in Struts 2.
|
< 1 Hr. | 2623 | |||||||||
CVE-2016-2098
This exercise covers a remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data
|
< 1 Hr. | 3455 | |||||||||
CVE-2014-4511: Gitlist RCE
This exercise explains how you can exploit a vulnerability published in 2014 in Gitlist.
|
-- | 0 | |||||||||
ECDSA
crypto
This exercise covers the exploitation of a weakness in the usage of ECDSA
|
2-4 Hr. | 331 | |||||||||
Werkzeug DEBUG
This challenge was written for Ruxcon CTF 2015 and cover the Debug mode of Werkzeug/Flask
|
< 1 Hr. | 1557 | |||||||||
Padding Oracle
This exercise covers an attack against CBC mode. This attack can be used to decrypt data and re-encrypt arbitrary data
|
1-2 Hr. | 808 | |||||||||
Unickle
This challenge was written for Ruxcon CTF 2015. It's an SQL injection mixed with a remote code execution.
|
1-2 Hr. | 648 | |||||||||
CVE-2015-3224
This exercise is a challenge written for Nullcon CTF in 2015
|
< 1 Hr. | 1564 | |||||||||
Luhn
This challenge was written for Ruxcon CTF 2015. It's an SQL injection with a twist
|
2-4 Hr. | 597 | |||||||||
CVE-2013-0156: Rails Object Injection
This exercise covers the exploitation of a code execution in Ruby-on-Rails using XML and YAML.
|
< 1 Hr. | 3819 | |||||||||
JSON Web Token II
jwt
This exercise covers the exploitation of an issue with some implementations of JWT
|
1-2 Hr. | 3531 | |||||||||
CVE-2016-0792
This exercise covers the exploitation of an Xstream vulnerability in Jenkins
|
< 1 Hr. | 4555 | |||||||||
ObjectInputStream
This exercise covers the exploitation of a call to readObject in a Spring application
|
< 1 Hr. | 4102 | |||||||||
XMLDecoder
This exercise covers the exploitation of an application using XMLDecoder
|
< 1 Hr. | 5097 | |||||||||
CVE-2014-1266
This exercise covers how to intercept an HTTPs connection
|
1-2 Hr. | 1042 | |||||||||
CVE-2011-0228
This exercise covers how to intercept an HTTPs connection
|
1-2 Hr. | 1195 | |||||||||
Intercept 03
This exercise covers how to intercept an HTTPs connection with hostname verification.
|
< 1 Hr. | 1469 | |||||||||
Intercept 02
This exercise covers how to intercept an HTTPs connection.
|
< 1 Hr. | 1621 | |||||||||
Intercept 01
This exercise covers how to intercept an HTTP connection.
|
1-2 Hr. | 1790 | |||||||||
Struts devMode
This exercise covers how to get code execution when a Struts application is running in devMode
|
-- | 0 | |||||||||
JSON Web Token
jwt
This exercise covers the exploitation of a signature weakness in a JWT library.
|
< 1 Hr. | 9524 | |||||||||
Cross-Origin Resource Sharing
This exercise covers Cross-Origin Resource Sharing and how it can be used to bypass CSRF protection if it's misconfigured
|
-- | 0 | |||||||||
API to Shell
API
This exercise covers the exploitation of PHP type confusion to bypass a signature and the exploitation of unserialize.
|
2-4 Hr. | 3302 | |||||||||
Pickle Code Execution
This exercise covers the exploitation of Python's pickle when used to deserialize untrusted data
|
< 1 Hr. | 6083 | |||||||||
Play XML Entities
This exercise covers the exploitation of XML entities in the Play framework
|
1-2 Hr. | 2138 | |||||||||
CVE-2014-6271/Shellshock
This exercise covers the exploitation of a Bash vulnerability through a CGI.
|
< 1 Hr. | 8511 | |||||||||
Play Session Injection
This exercise covers the exploitation of a session injection in the Play framework. This issue can be used to tamper with the content of the session while bypassing the signing mechanism
|
< 1 Hr. | 2741 | |||||||||
CVE-2007-1860: mod_jk double-decoding
This exercise covers the exploitation of CVE-2007-1860. This vulnerability allows an attacker to gain access to inaccessible pages using crafted requests. This is a common trick that a lot of testers miss.
|
1-2 Hr. | 5802 | |||||||||
XSS and MySQL FILE
XSS
This exercise explains how to exploit a Cross-Site Scripting vulnerability to obtain an administrator's cookies, and how you can use their session to gain access to the administration panel, and find a SQL injection to gain code execution
|
-- | 0 | |||||||||
Electronic Code Book
crypto
This exercise explains how you can tamper with encrypted cookies to access another user's account
|
1-2 Hr. | 5561 | |||||||||
Web for Pentester II
This exercise is a set of the most common web vulnerabilities.
|
-- | 0 | |||||||||
From SQL Injection to Shell II
SQL Injection
This exercise explains how you can, from a blind SQL injection, gain access to the administration console. Then once in the administration console, how you can run commands on the system.
|
-- | 0 | |||||||||
CVE-2012-6081: MoinMoin code execution
This exercise explains how you can exploit CVE-2012-6081 to gain code execution. This vulnerability was exploited to compromise Debian's wiki and Python documentation website
|
-- | 0 | |||||||||
Web for Pentester
This exercise is a set of the most common web vulnerabilities.
|
-- | 0 | |||||||||
Axis2 Web service and Tomcat Manager
This exercise explains the interactions between Tomcat and Apache, then it shows how to call and attack an Axis2 Web service. Using information retrieved from this attack, you will be able to gain access to the Tomcat Manager and deploy a WebShell to gain command execution.
|
-- | 0 | |||||||||
CVE-2008-1930: Wordpress 2.5 Cookie Integrity Protection Vulnerability
This exercise explains how you can exploit CVE-2008-1930 to gain access to the administration interface of a Wordpress installation.
|
< 1 Hr. | 8 | |||||||||
From SQL Injection to Shell: PostgreSQL edition
SQL Injection
This exercise explains how you can from a SQL injection gain access to the administration console, and from there, how you can run commands on the underlying system
|
-- | 0 | |||||||||
Rack Cookies and Commands injection
After a short brute force introduction, this exercise explains the tampering of rack cookies and how you can even manage to modify a signed cookie (if the secret is trivial). Using this issue, you will be able to escalate your privileges and gain command execution
|
-- | 0 | |||||||||
Linux Host Review
This exercise explains how to perform a Linux host review, what and how you can check the configuration of a Linux server to ensure it is securely configured. The reviewed system is a traditional Linux-Apache-Mysql-PHP (LAMP) server used to host a blog.
|
-- | 0 | |||||||||
CVE-2012-2661: ActiveRecord SQL injection
This exercise explains how you can exploit CVE-2012-2661 to retrieve information from a database
|
-- | 0 | |||||||||
CVE-2012-1823: PHP CGI
This exercise explains how you can exploit CVE-2012-1823 to retrieve the source code of an application and gain code execution.
|
-- | 0 | |||||||||
PHP Include And Post Exploitation
This exercise describes the exploitation of a local file include with limited access. Once code execution is gained, you will see some post exploitation tricks.
|
-- | 0 | |||||||||
From SQL Injection to Shell
SQL Injection
This exercise demonstrates how to leverage a SQL injection to gain access to the admin console, and from there, how to execute commands on the underlying system
|
< 1 Hr. | 7789 | |||||||||
Introduction 01
This exercise will guide through the process of scoring an exercise to mark it as completed
|
< 1 Hr. | 28241 | |||||||||
Introduction 02
This exercise will guide through the process of scoring an exercise to mark it as completed. Finding the key is just a little bit harder than the previous exercise.
|
< 1 Hr. | 27888 | |||||||||
Introduction 03
This exercise will guide through the process of scoring an exercise to mark it as completed. However, this time, you will run commands on the underlying operating system. You will need to run the score command with your UUID.
|
< 1 Hr. | 27249 | |||||||||
Introduction 00
This exercise will guide you through the process of scoring on an exercise to get it marked as completed
|
< 1 Hr. | 29213 | |||||||||
Unix 00
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 24465 | |||||||||
Unix 01
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 23877 | |||||||||
Unix 02
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 23597 | |||||||||
Unix 03
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 23285 | |||||||||
Unix 04
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 22957 | |||||||||
Unix 05
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 21828 | |||||||||
Unix 06
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 20935 | |||||||||
Unix 07
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 20579 | |||||||||
Unix 08
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 20244 | |||||||||
Unix 09
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 19613 | |||||||||
Unix 10
This exercise is one of our challenges to help you learn more about Unix/Linux
|
< 1 Hr. | 19092 | |||||||||
PCAP 01
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 7267 | |||||||||
PCAP 02
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 7091 | |||||||||
PCAP 03
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 7000 | |||||||||
PCAP 04
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 6747 | |||||||||
PCAP 05
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 6628 | |||||||||
PCAP 06
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 6527 | |||||||||
PCAP 07
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 6466 | |||||||||
PCAP 08
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 6407 | |||||||||
PCAP 09
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 6375 | |||||||||
PCAP 10
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 6053 | |||||||||
PCAP 11
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 6045 | |||||||||
PCAP 12
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 6028 | |||||||||
PCAP 13
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 6073 | |||||||||
PCAP 14
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 6051 | |||||||||
PCAP 15
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 6034 | |||||||||
PCAP 16
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 6011 | |||||||||
PCAP 17
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5957 | |||||||||
PCAP 18
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5951 | |||||||||
PCAP 19
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5928 | |||||||||
PCAP 20
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5807 | |||||||||
PCAP 21
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5751 | |||||||||
PCAP 22
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5742 | |||||||||
PCAP 23
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5730 | |||||||||
PCAP 24
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5719 | |||||||||
PCAP 25
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5719 | |||||||||
PCAP 26
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5713 | |||||||||
PCAP 27
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5660 | |||||||||
PCAP 28
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5634 | |||||||||
PCAP 29
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5618 | |||||||||
PCAP 30
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5591 | |||||||||
PCAP 31
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5569 | |||||||||
PCAP 32
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5493 | |||||||||
PCAP 33
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5390 | |||||||||
PCAP 34
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5457 | |||||||||
PCAP 35
This exercise is one of our challenges to help you learn how to analyze PCAP files
|
< 1 Hr. | 5532 | |||||||||
Android 08
This exercise will guide you through the process of reversing a simple obfuscated Android code to recover the encrypted data
|
1-2 Hr. | 1213 | |||||||||
Code Review 01
This exercise is one of our challenges to help you learn how to review real source code
|
1-2 Hr. | 546 | |||||||||
Recon 00
This exercise covers the robots.txt file
|
< 1 Hr. | 16300 | |||||||||
Recon 02
This exercise covers the security.txt file
|
< 1 Hr. | 13523 | |||||||||
Recon 03
This exercise covers directory listing
|
< 1 Hr. | 12029 | |||||||||
Recon 10
This exercise covers visual content discovery
|
< 1 Hr. | 5023 | |||||||||
Recon 09 | < 1 Hr. | 7819 | |||||||||
Code Review 17
This exercise is one of our challenges to help you learn how to review real source code
|
1-2 Hr. | 142 | |||||||||
Java Snippet #01
This challenge covers the review of a snippet of code written in Java
|
< 1 Hr. | 1233 | |||||||||
Java Snippet #02
This challenge covers the review of a snippet of code written in Java
|
< 1 Hr. | 1211 | |||||||||
Java Snippet #03
This challenge covers the review of a snippet of code written in Java
|
< 1 Hr. | 1060 | |||||||||
CVE-2021-4xx50
This challenge covers the review of a CVE and its patch
|
< 1 Hr. | 550 | |||||||||
No search results found... |