Exercises

This challenge is the second in the fastjson @JSONType series. Unlike lab I it runs on a stock Spring Boot app on the latest JDK that parses on the Tomcat request thread with no classloader wiring. A direct jar:http payload only yields SSRF there; remote code execution comes from the two-request /proc/self/fd variant, whose file: class name has no '//', so Tomcat's own webapp classloader defines it on the request thread.

This challenge covers a remote code execution in fastjson 1.2.83 with autoType disabled, by abusing the @JSONType trust probe in ParserConfig.checkAutoType together with a jar:http:// class name loaded through Spring Boot's LaunchedURLClassLoader on JDK 8.

This exercise covers the exploitation of CVE-2025-25291 (impacting ruby-saml)

This exercise covers the exploitation of CVE-2025-29775 (impacting xml-crypto) without XMLResponse

This exercise covers the exploitation of CVE-2025-29775 (impacting xml-crypto)

This exercise covers the exploitation of polyglot token against python_jwt (CVE-2022-39227)

This exercise covers the exploitation of algorithm confusion when no public key is available with a ECDSA key

This exercise covers the creation of a malicious IDP to forge an assertion

This exercise covers the exploitation of an XSS in an OAuth2 Authorization Server

This exercise covers the exploitation of algorithm confusion when no public key is available

This exercise covers how to use Signature Wrapping to become an arbitrary user

This exercise covers how to use Signature Wrapping to become an arbitrary user

This exercise covers the exploitation of a predictable state in an OAuth2 Client

This exercise covers the exploitation of a predictable state in an OAuth2 Client

This exercise covers the exploitation of a Cross-Site Scripting in an OAuth2 Client and Server

This exercise covers the exploitation of the HTTP HEAD issue impacting Github in 2019

This exercise covers how to use the x5u header to bypass an authentication based on JWT.

This exercise covers how to use the jku header to bypass an authentication based on JWT.

This exercise covers how to use the jku header to bypass an authentication based on JWT.

This exercise covers how to use the jku header to bypass an authentication based on JWT.

This exercise covers how to get code execution against the Git self hosted tool: Gogs.

This exercise covers how to use the jku header to bypass an authentication based on JWT.

This exercise covers how to get code execution against the Git self hosted tool: Gogs.

This exercise will guide you through the process of reversing a simple obfuscated Android code to recover the encrypted data

This exercise will guide you through the process of reversing a simple obfuscated Android code to recover the encrypted data

This exercise will guide you through the process of reversing a simple obfuscated Android code to recover the encrypted data

This exercise covers how to gain access to an administration interface using SQL injection followed by how to get command execution using ImageTragick

This exercise covers how to get code execution by chaining vulnerabilities in a Ruby-on-Rails application

This exercise covers the exploitation of a weakness in the usage of ECDSA