Exercises

This exercise details the exploitation of a vulnerability in Git Sub module that can be used to get command execution

This exercise details the exploitation of a vulnerability in Cisco's node-jose, a JavaScript library created to manage JWT

This exercise covers the exploitation of signature of non-fixed size messages with CBC-MAC

This exercise is one of our challenges on vulnerabilities related to MongoDB

This exercise covers the exploitation of a weakness in the usage of ECDSA

This challenge was written for Ruxcon CTF 2015. It's an SQL injection mixed with a remote code execution.

This challenge was written for Ruxcon CTF 2015. It's an SQL injection with a twist

This exercise covers how to intercept an HTTPs connection

This exercise covers how to intercept an HTTPs connection

This exercise covers the exploitation of PHP type confusion to bypass a signature and the exploitation of unserialize.

This exercise explains how you can exploit CVE-2012-6081 to gain code execution. This vulnerability was exploited to compromise Debian's wiki and Python documentation website

After a short brute force introduction, this exercise explains the tampering of rack cookies and how you can even manage to modify a signed cookie (if the secret is trivial). Using this issue, you will be able to escalate your privileges and gain command execution

This exercise explains how to perform a Linux host review, what and how you can check the configuration of a Linux server to ensure it is securely configured. The reviewed system is a traditional Linux-Apache-Mysql-PHP (LAMP) server used to host a blog.

This exercise explains how you can exploit CVE-2012-2661 to retrieve information from a database