Exercises

This exercise covers the exploitation of an XXE in an ODF Parser

The model is told to keep a secret key and refuses to reveal it directly. The rule only forbids telling the key, not repeating the instructions that contain it. Make the model recite its own system prompt and the key comes with it.

Multiple extraction vectors are blocked. Find a creative approach the rules don't anticipate.

No guardrails at all. Simply ask the model for the secret key.

The model is told to refuse key requests. Use social engineering to convince it to share anyway.

This exercise covers the standard Node.js RCE chain: process -> mainModule -> require('child_process') -> execSync.

This exercise covers navigating __proto__, .constructor, and .prototype from a string literal to reach the Function constructor.

This exercise covers using Function(...)() as an eval alternative to execute arbitrary code in an app that blocks eval.

This exercise covers bypassing JWT refresh token validation to maintain unauthorized access.

This exercise covers exploiting a JWT signature leak to forge authentication tokens.

This exercise covers exploiting JWT algorithm validation flaws to bypass signature verification.

This exercise covers how to bypass a weak JWT Revocation Mechanism.

This exercise covers a simple authorization issue in a GraphQL application.

This exercise covers a simple authorization issue in a GraphQL application.

This challenge covers the review of a snippet of code written in Golang.

This challenge covers the review of a snippet of code written in Golang.

This challenge covers the review of a CVE in a Java codebase and its patch

This challenge covers the review of a CVE in a Java codebase and its patch

This challenge covers the review of a CVE in a Java codebase and its patch

This challenge covers the review of a CVE in a Java codebase and its patch

This challenge covers the review of a CVE in a Java codebase and its patch

This challenge covers the review of a CVE in a Java codebase and its patch

This challenge covers the review of a CVE in a Java codebase and its patch

This challenge covers the review of a CVE in a Java codebase and its patch

This challenge covers the review of a snippet of code written in Golang.

This challenge covers the review of a snippet of code written in Golang.

This challenge covers the review of a snippet of code written in Golang.

This challenge covers the review of a CVE in a Java codebase and its patch

This challenge covers the review of a CVE in a Java codebase and its patch

This challenge covers the review of a CVE in a Java codebase and its patch