Exercises

This challenge covers an unauthenticated remote code execution reproducing MantisBT CVE-2026-49273: a value is validated with eval('return; ...'), but PHP hoists class declarations past the return; at compile time, letting an attacker pre-declare the class the app then autoloads and instantiates.

This challenge covers gaining a shell on WordPress by chaining CVE-2026-63030 and CVE-2026-60137.

This exercise covers the exploitation of an RCE in SAML by leveraging a vulnerable version of xmlsec

This exercise covers how one can leverage latex when pdflatex is used with the --shell-escape option to gain command execution.

This exercise covers how one can leverage image processing in ActiveStorage to gain command execution.

This exercise details how to exploit an application vulnerable to cache poisoning

This exercise details how to exploit an application vulnerable to cache deception

This exercise details how to exploit an application vulnerable to cache deception

This exercise covers the exploitation of a SSRF in PySAML2

This exercise covers the exploitation of CVE-2021-21239 (PySAML2)

This exercise covers the exploitation of a Signature Wrapping Issue in passport-saml (CVE-2022-39299)

This exercise covers the exploitation of CVE-2022-21449 against a Java Application relying on JWT

This exercise covers the exploitation of an XSS in an OAuth2 Authorization Server

This exercise covers the exploitation of a comment injection vulnerability in SAML

This exercise covers how to pass the SAMLResponse from one Service Provider to another

This exercise covers the exploitation of a state fixation in an OAuth2 Client

This exercise covers the exploitation of a Service Provider (SP) that doesn't check the certificate provided in the SAMLResponse

This exercise covers the exploitation of a known key in SAML

This exercise covers the exploitation of a comment injection vulnerability in SAML

This exercise covers how to gain access to an administration interface using a SQL injection, and how to get command execution using Ghostscript

This exercise covers the exploitation of a CSRF in an OAuth2 Client

This exercise covers the exploitation of a CSRF in an OAuth2 Client

This exercise covers how to use an SVG to trigger a Cross-Site-Scripting

This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the Origin and X-Frame-Options is used

This exercise covers how insecure calls to the JavaScript function postMessage() can be used to trigger a Cross-Site Scripting

This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the Origin

This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information

This exercise covers Cross-Site WebSocket Hijacking and how it can be used to gain access to sensitive information

This exercise covers Cross-Origin Resource Sharing and how it can be used to get access to sensitive data.