Sign in Create Account

Exercises

Exercise Avg. Time Difficulty Solved by Tier
DOMPDF RCE
This exercise covers the exploitation of a vulnerability in the DOMPDF library
 < 1 Hr. medium 162 PRO
XSL PHP II
This exercise covers the exploitation of a PHP application using XSL
< 1 Hr. medium 248 PRO
API Payments 04
This exercise covers how to abuse a shopping cart allowing users to apply a voucher..
 < 1 Hr. medium 1262 PRO
XSL PHP
This exercise covers the exploitation of a PHP application using XSL
< 1 Hr. medium 292 PRO
API Payments 03
This exercise covers a simple payments bypass.
 < 1 Hr. medium 1373 PRO
CVE-2020-13xxx
This challenge covers the review of a CVE and its patch
 < 1 Hr. medium 699 PRO
Code Review 18
This exercise is one of our challenges to help you learn how to review real source code
 1-2 Hr. medium 412 PRO
API Payments 02
This exercise covers a simple payments bypass.
 < 1 Hr. medium 1541 PRO
GCM Nonce Reuse
This challenge covers the impact of nonce reuse on GCM
 < 1 Hr. medium 193 PRO
CVE-2019-5x2x
This challenge covers the review of a CVE and its patch
 < 1 Hr. medium 638 PRO
Java Snippet #09
This challenge covers the review of a snippet of code written in Java
 < 1 Hr. medium 1419 PRO
CVE-2022-26xx9
This challenge covers a vulnerable snippet in a real Java application
 < 1 Hr. medium 653 PRO
Mongo IDOR
This challenge covers how to exploit an IDOR when Mongo IDs are used
< 1 Hr. medium 1224 PRO
CVE-2008-5x8x_ii
This challenge covers the review of a CVE and its patch
 < 1 Hr. medium 669 PRO
Java Snippet #06
This challenge covers the review of a snippet of code written in Java
 < 1 Hr. medium 1443 PRO
CVE-2022-21449 JWT
This exercise covers the exploitation of CVE-2022-21449 against a Java Application relying on JWT
 < 1 Hr. medium 189 PRO
CVE-2021-33564 Argument Injection in Ruby Dragonfly
This exercise covers how you can get arbitrary file read using CVE-2021-33564 against Refinery CMS
 < 1 Hr. medium 156 PRO
Mongo IDOR II
This challenge covers how to recover a Mongo ID to leverage an IDOR
 < 1 Hr. medium 379 PRO
PHP Snippet #09
This challenge covers the review of a snippet of code written in PHP
 < 1 Hr. medium 1590 PRO
CVE-2022-21724: JDBC RCE PostgreSQL
This challenge covers how to gain code execution by leveraging a JDBC connection string with PostgreSQL
 < 1 Hr. medium 204 PRO
HTTP 41
This challenge covers how to send specific HTTP requests
 < 1 Hr. medium 2747 PRO
HTTP 43
This challenge covers how to send specific HTTP requests
 < 1 Hr. medium 2677 PRO
HTTP 42
This challenge covers how to send specific HTTP requests
 < 1 Hr. medium 2774 PRO
CVE-2021-381xx
This challenge covers the review of a CVE and its patch
 < 1 Hr. medium 704 PRO
TypeScript Snippet #05
This challenge covers the review of a snippet of code written in TypeScript
 < 1 Hr. medium 1329 PRO
TypeScript Snippet #09
This challenge covers the review of a snippet of code written in TypeScript
 < 1 Hr. medium 1236 PRO
API 08
This exercise covers how one can inspect HTTP responses to identify information leaks.
 < 1 Hr. medium 1842 PRO
CVE-2021-4xx50
This challenge covers the review of a CVE and its patch
 < 1 Hr. medium 860 PRO
JDBC RCE
This exercise is one of our challenges to help you learn Java Serialisation exploitation
 2-4 Hr. medium 74 PRO
Golang Snippet #12
This challenge covers the review of a snippet of code written in Golang
 < 1 Hr. medium 1115 PRO
‹ 1 2 3 4 5 6 … 9 ›
Showing 61–90 of 262 exercises