Exercises

This challenge covers exploiting Object.equals(), triggered during HashSet and HashMap deserialization, as a gadget entry point.

This challenge covers exploiting toString() through a wrapper class, the technique behind BadAttributeValueExpException in Commons Collections.

This challenge covers chaining multiple classes together into a multi-class gadget chain, bridging single-class exploits to real-world attacks.

This challenge covers using readResolve() as a deserialization entry point to trigger a gadget chain after the object is restored.

Gain code execution through an unsafe module_eval call during WSDL import.

Gain code execution by injecting Python through a crafted JSON Schema when the generated Pydantic model is imported.

The system prompt explicitly establishes an instruction hierarchy. Find a way to confuse or bypass the priority system.

This challenge covers an unauthenticated remote code execution reproducing MantisBT CVE-2026-49273: a value is validated with eval('return; ...'), but PHP hoists class declarations past the return; at compile time, letting an attacker pre-declare the class the app then autoloads and instantiates.

This challenge covers gaining a shell on WordPress by chaining CVE-2026-63030 and CVE-2026-60137.

This exercise covers the exploitation of an RCE in SAML by leveraging a vulnerable version of xmlsec

This exercise covers bypassing static-eval parameter validation using destructured parameters (ObjectPattern).

This exercise covers exploiting the original unpatched static-eval with unrestricted property access on functions.

This exercise covers bypassing post-2.0 static-eval that blocks member access on functions, using anonymous function bodies.

This exercise covers escaping vm.runInNewContext when the context is created with Object.create(null) so this.constructor is undefined.

This exercise covers escaping vm.runInNewContext when specific safe objects are provided but frozen, using Error objects or Promise callbacks.

This exercise covers bypassing regex filters with hex escapes, unicode escapes, or base64 decoding.

This exercise covers bypassing string sanitization by sending an object when the sanitizer expects a string.

This exercise covers bypassing AST-based sandbox filtering using computed property access or Reflect.get().

This exercise covers escaping Node.js vm.runInNewContext with an empty sandbox object via the constructor chain.

This exercise covers bypassing indexOf/includes blocklists with bracket notation and string concatenation.

This exercise covers how one can leverage latex when pdflatex is used with the --shell-escape option to gain command execution.

This exercise covers how one can leverage image processing in ActiveStorage to gain command execution.

This exercise covers how to exploit an authorization issue in an API.

This exercise covers how to exploit an authorization issue in an API.