Sign in Create Account

Exercises

Exercise Avg. Time Difficulty Solved by Tier
Code Review 02
This exercise is one of our challenges to help you learn how to review real source code
 < 1 Hr. medium 721 PRO
postMessage() IV
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the Origin and X-Frame-Options is used
 < 1 Hr. medium 1022 PRO
Code Review 01
This exercise is one of our challenges to help you learn how to review real source code
 < 1 Hr. medium 986 PRO
Spring Actuators
This exercise covers how you can gain code execution using Spring Actuators when Spring Cloud is used.
 < 1 Hr. medium 318 PRO
postMessage() III
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to trigger a Cross-Site Scripting
 < 1 Hr. medium 1039 PRO
postMessage() II
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the Origin
 < 1 Hr. medium 1155 PRO
PHP phar://
This exercise covers how the PHP phar:// handler can be used to gain code execution using PHP unserialize.
 < 1 Hr. medium 383 PRO
JSON Web Encryption
This exercise covers how you can create your own JWE if you have access to the public key used by the server
 < 1 Hr. medium 570 PRO
postMessage()
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information
 < 1 Hr. medium 1324 PRO
Cross-Site WebSocket Hijacking
This exercise covers Cross-Site WebSocket Hijacking and how it can be used to gain access to sensitive information
 < 1 Hr. medium 1148 PRO
Cross-Origin Resource Sharing II
This exercise covers Cross-Origin Resource Sharing and how it can be used to get access to sensitive data.
 < 1 Hr. medium 1099 PRO
OAuth2: Client OpenRedirect
This exercise covers the exploitation of an OpenRedirect in an OAuth2 Client
 < 1 Hr. medium 885 PRO
CVE-2019-5420
This exercise details the exploitation of CVE-2019-5420 to forge a session as another user
 < 1 Hr. medium 955 PRO
GraphQL: SQL Injection
This exercise covers how to use introspection and a SQL injection to get access to additional information in GraphQL.
 < 1 Hr. medium 1536 PRO
OAuth2: Authorization Server OpenRedirect
This exercise covers the exploitation of an OpenRedirect in an OAuth2 Authorization Server
 < 1 Hr. medium 1003 PRO
SAML: Signature Stripping
This exercise covers the exploitation of a signature stripping vulnerability in SAML
 < 1 Hr. medium 2222 PRO
Android 05
This exercise will guide you through the process of reversing a simple obfuscated Android code to recover the encrypted data
 < 1 Hr. medium 2087 PRO
Ruby 2.x Universal RCE Deserialization Gadget Chain
This exercise covers how to get code execution by using a Ruby Universal Gadget when an attacker controls the data passed to Marshal.load()
 < 1 Hr. medium 1462 PRO
CVE-2018-10933: LibSSH auth bypass
This exercise covers how to bypass authentication on an SSH server based on libssh to gain a shell on the affected system
 medium 0 FREE
Android 04
This exercise will guide you through the process of reversing a simple Android code
 < 1 Hr. medium 2633 PRO
Android 03
This exercise will guide you through the process of extracting simple information from an APK
 < 1 Hr. medium 3484 PRO
Introduction to CSP
This exercise details the exploitation of a XSS in a simple web application that uses Content Security Policy
 < 1 Hr. medium 2570 PRO
Git Information Leak II
This exercise details how to retrieve information from an exposed .git directory on a web server, provided directory listing is disabled
 < 1 Hr. medium 2682 PRO
CVE-2016-5386: HTTPoxy/Golang HTTProxy namespace conflict
This exercise covers the exploitation of HTTPoxy against an old version of Golang
 < 1 Hr. medium 961 PRO
Unix 31
This exercise is one of our challenges to help you learn more about Unix/Linux
 < 1 Hr. medium 14377 PRO
Unix 30
This exercise is one of our challenges to help you learn more about Unix/Linux
 < 1 Hr. medium 14405 PRO
CBC-MAC II Crypto
This exercise covers the exploitation of an application using CBC-MAC when an attacker has control over the IV
 < 1 Hr. medium 1802 PRO
JWT VI JWT
This exercise covers the exploitation of an injection in the kid element of a JWT. This injection can be used to bypass the signature mechanism
 < 1 Hr. medium 2655 PRO
CVE-2018-6574: go get RCE
This exercise covers a remote command execution in Golang's go get command.
 < 1 Hr. medium 932 PRO
Unix 15
This exercise is one of our challenges to help you learn more about Unix/Linux
 < 1 Hr. medium 16709 PRO
‹ 1 … 4 5 6 7 8 9 10 ›
Showing 181–210 of 273 exercises