Penetration Testing, Security Code Review and Web App Security Exercises

Free PRO CVE Easy Medium Hard XSS Code Review API SSRF HTTP RECON CSRF SQLi

Exercise	Avg. Time	Solved by	Tier
CVE-2016-5386: HTTPoxy/Golang HTTProxy namespace conflict This exercise covers the exploitation of HTTPoxy against an old version of Golang	< 1 Hr.	956	PRO
CVE-2018-6574: go get RCE This exercise covers a remote command execution in Golang's go get command.	< 1 Hr.	924	PRO
CVE-2016-10033: PHPMailer RCE This exercise covers a remote code execution vulnerability in PHPMailer	< 1 Hr.	3855	PRO
CVE-2016-2098 This exercise covers a remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data	< 1 Hr.	3763	PRO
CVE-2014-4511: Gitlist RCE This exercise explains how you can exploit a vulnerability published in 2014 in Gitlist.	< 1 Hr.	19	FREE
CVE-2015-3224 This exercise is a challenge written for Nullcon CTF in 2015	< 1 Hr.	1649	PRO
CVE-2013-0156: Rails Object Injection This exercise covers the exploitation of a code execution in Ruby-on-Rails using XML and YAML.	< 1 Hr.	4091	PRO
CVE-2016-0792 This exercise covers the exploitation of an Xstream vulnerability in Jenkins	< 1 Hr.	4906	PRO
CVE-2007-1860: mod_jk double-decoding This exercise covers the exploitation of CVE-2007-1860. This vulnerability allows an attacker to gain access to inaccessible pages using crafted requests. This is a common trick that a lot of testers miss.	< 1 Hr.	6230	FREE
CVE-2008-1930: WordPress Cookie Integrity Flaw This exercise explains how you can exploit CVE-2008-1930 to gain access to the administration interface of a Wordpress installation.	< 1 Hr.	36	FREE
CVE-2012-1823: PHP CGI This exercise explains how you can exploit CVE-2012-1823 to retrieve the source code of an application and gain code execution.		1	FREE

‹ 1 2 ›

Showing 31–41 of 41 exercises