Penetration Testing, Security Code Review and Web App Security Exercises

Free PRO CVE Easy Medium Hard XSS Code Review API SSRF HTTP RECON CSRF SQLi

Exercise	Avg. Time	Solved by	Tier
CVE-2026-24895: FrankenPHP Path Confusion RCE using Unicode	< 1 Hr.	21	PRO
CVE-2022-24720 This exercise covers how one can leverage image processing in ActiveStorage to gain command execution.	1-2 Hr.	36	PRO
CVE-2024-47081	< 1 Hr.	26	PRO
SAML: CVE-2025-25291 This exercise covers the exploitation of CVE-2025-25291 (impacting ruby-saml)	2-4 Hr.	18	PRO
SAML: CVE-2025-29775 Signed Metadata This exercise covers the exploitation of CVE-2025-29775 (impacting xml-crypto) without XMLResponse	2-4 Hr.	14	PRO
SAML: CVE-2025-29775 This exercise covers the exploitation of CVE-2025-29775 (impacting xml-crypto)	1-2 Hr.	21	PRO
SAML: CVE-2021-21239 This exercise covers the exploitation of CVE-2021-21239 (PySAML2)	1-2 Hr.	132	PRO
CVE-2022-21449 JWT This exercise covers the exploitation of CVE-2022-21449 against a Java Application relying on JWT	< 1 Hr.	185	PRO
Gogs RCE II This exercise covers how to get code execution against the Git self hosted tool: Gogs.	< 1 Hr.	617	PRO
Gogs RCE This exercise covers how to get code execution against the Git self hosted tool: Gogs.	1-2 Hr.	690	PRO
CVE-2016-10033: PHPMailer RCE This exercise covers a remote code execution vulnerability in PHPMailer	< 1 Hr.	3829	PRO
CVE-2016-2098 This exercise covers a remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data	< 1 Hr.	3740	PRO
CVE-2015-3224 This exercise is a challenge written for Nullcon CTF in 2015	< 1 Hr.	1643	PRO
CVE-2013-0156: Rails Object Injection This exercise covers the exploitation of a code execution in Ruby-on-Rails using XML and YAML.	< 1 Hr.	4075	PRO
CVE-2016-0792 This exercise covers the exploitation of an Xstream vulnerability in Jenkins	< 1 Hr.	4887	PRO

Showing 1–15 of 15 exercises