Exercises

This challenge is the second in the fastjson @JSONType series. Unlike lab I it runs on a stock Spring Boot app on the latest JDK that parses on the Tomcat request thread with no classloader wiring. A direct jar:http payload only yields SSRF there; remote code execution comes from the two-request /proc/self/fd variant, whose file: class name has no '//', so Tomcat's own webapp classloader defines it on the request thread.

This challenge covers a remote code execution in fastjson 1.2.83 with autoType disabled, by abusing the @JSONType trust probe in ParserConfig.checkAutoType together with a jar:http:// class name loaded through Spring Boot's LaunchedURLClassLoader on JDK 8.

This challenge covers the review of a CVE in a Golang codebase and its patch

This challenge covers the exploitation of tag truncation on GCM

This exercise covers the exploitation of CVE-2025-25291 (impacting ruby-saml)

This exercise covers the exploitation of CVE-2025-29775 (impacting xml-crypto) without XMLResponse

This exercise covers the exploitation of CVE-2025-29775 (impacting xml-crypto)

Leverage a PHP trick to bypass CSP

Find the XSS by leveraging backreferences in a regular expression

This exercise covers how to exploit a leaked encrypted password with an API.

This exercise covers a complex filter bypass in API.

This exercise covers the exploitation of polyglot token against python_jwt (CVE-2022-39227)

This exercise is one of our challenges to help you learn Java Serialisation exploitation

This exercise covers the exploitation of algorithm confusion when no public key is available with a ECDSA key

This exercise covers the creation of a malicious IDP to forge an assertion

This exercise covers the automation of the exploitation of a vulnerability in the DOMPDF library

This exercise covers the exploitation of a PHP application using XSL

This exercise covers how to abuse a shopping cart allowing users to apply a voucher.

This challenge covers the review of a CVE and its patch

This challenge covers the review of a snippet of code written in PHP

This exercise covers how you can gain code execution when an application is using Ox to deserialize data and is running on Ruby 2.7

This challenge covers how to send specific HTTP requests

This exercise covers how you can gain code execution when an application is using Ox to deserialize data and is running on Ruby 2.3

This exercise covers how you can gain code execution when an application uses exiftool on user-controlled files

This exercise covers how you can read arbitrary files when an application uses ffmpeg to render videos from a video you provide

This exercise covers the exploitation of an XSS in an OAuth2 Authorization Server

This exercise covers the exploitation of algorithm confusion when no public key is available

This exercise covers how to use Signature Wrapping to become an arbitrary user