Penetration Testing, Security Code Review and Web App Security Exercises

Free PRO CVE Easy Medium Hard XSS Code Review API SSRF HTTP RECON CSRF SQLi

Exercise	Avg. Time	Solved by	Tier
CVE-2016-10033: PHPMailer RCE This exercise covers a remote code execution vulnerability in PHPMailer	< 1 Hr.	3801	PRO
CVE-2016-2098 This exercise covers a remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data	< 1 Hr.	3714	PRO
CVE-2014-4511: Gitlist RCE This exercise explains how you can exploit a vulnerability published in 2014 in Gitlist.	< 1 Hr.	13	FREE
CVE-2015-3224 This exercise is a challenge written for Nullcon CTF in 2015	< 1 Hr.	1632	PRO
CVE-2013-0156: Rails Object Injection This exercise covers the exploitation of a code execution in Ruby-on-Rails using XML and YAML.	< 1 Hr.	4022	PRO
CVE-2016-0792 This exercise covers the exploitation of an Xstream vulnerability in Jenkins	< 1 Hr.	4860	PRO
CVE-2007-1860: mod_jk double-decoding This exercise covers the exploitation of CVE-2007-1860. This vulnerability allows an attacker to gain access to inaccessible pages using crafted requests. This is a common trick that a lot of testers miss.	1-2 Hr.	6176	FREE
CVE-2008-1930: WordPress Cookie Integrity Flaw This exercise explains how you can exploit CVE-2008-1930 to gain access to the administration interface of a Wordpress installation.	< 1 Hr.	26	FREE
CVE-2012-1823: PHP CGI This exercise explains how you can exploit CVE-2012-1823 to retrieve the source code of an application and gain code execution.	--	1	FREE

‹ 1 2 ›

Showing 31–39 of 39 exercises