Exercises

This challenge covers an unauthenticated remote code execution reproducing MantisBT CVE-2026-49273: a value is validated with eval('return; ...'), but PHP hoists class declarations past the return; at compile time, letting an attacker pre-declare the class the app then autoloads and instantiates.

This challenge covers gaining a shell on WordPress by chaining CVE-2026-63030 and CVE-2026-60137.

This exercise covers the exploitation of an RCE in SAML by leveraging a vulnerable version of xmlsec

This exercise covers bypassing static-eval parameter validation using destructured parameters (ObjectPattern).

This exercise covers escaping vm.runInNewContext when specific safe objects are provided but frozen, using Error objects or Promise callbacks.

This exercise covers escaping vm.runInNewContext when the context is created with Object.create(null) so this.constructor is undefined.

This exercise covers exploiting the original unpatched static-eval with unrestricted property access on functions.

This exercise covers bypassing post-2.0 static-eval that blocks member access on functions, using anonymous function bodies.

This exercise covers bypassing AST-based sandbox filtering using computed property access or Reflect.get().

This exercise covers bypassing regex filters with hex escapes, unicode escapes, or base64 decoding.

This exercise covers escaping Node.js vm.runInNewContext with an empty sandbox object via the constructor chain.

This exercise covers bypassing string sanitization by sending an object when the sanitizer expects a string.

This exercise covers bypassing indexOf/includes blocklists with bracket notation and string concatenation.

This exercise covers how one can leverage latex when pdflatex is used with the --shell-escape option to gain command execution.

This exercise covers how one can leverage image processing in ActiveStorage to gain command execution.

This exercise covers how to exploit an authorization issue in an API.

This exercise covers how to exploit an authorization issue in an API.

This exercise covers how to exploit an authorization issue in an API.

This exercise covers how to exploit an authorization issue in an API.

This exercise covers how to exploit an authorization issue in an API.

This exercise covers how to exploit an ORM leak vulnerability

This exercise covers how to exploit an ORM leak vulnerability

This exercise covers how to exploit a simple ORM leak.

This exercise covers how to exploit a leaked encrypted password with an API.