Exercises

This challenge covers an unauthenticated remote code execution reproducing MantisBT CVE-2026-49273: a value is validated with eval('return; ...'), but PHP hoists class declarations past the return; at compile time, letting an attacker pre-declare the class the app then autoloads and instantiates.

This challenge is the second in the fastjson @JSONType series. Unlike lab I it runs on a stock Spring Boot app on the latest JDK that parses on the Tomcat request thread with no classloader wiring. A direct jar:http payload only yields SSRF there; remote code execution comes from the two-request /proc/self/fd variant, whose file: class name has no '//', so Tomcat's own webapp classloader defines it on the request thread.

This challenge covers a remote code execution in fastjson 1.2.83 with autoType disabled, by abusing the @JSONType trust probe in ParserConfig.checkAutoType together with a jar:http:// class name loaded through Spring Boot's LaunchedURLClassLoader on JDK 8.

This challenge covers gaining a shell on WordPress by chaining CVE-2026-63030 and CVE-2026-60137.

This exercise covers the exploitation of an RCE in SAML by leveraging a vulnerable version of xmlsec

This exercise covers how one can leverage latex when pdflatex is used with the --shell-escape option to gain command execution.

This exercise covers how one can leverage image processing in ActiveStorage to gain command execution.

This exercise covers the exploitation of CVE-2025-25291 (impacting ruby-saml)

This exercise covers the exploitation of CVE-2025-29775 (impacting xml-crypto) without XMLResponse

This exercise covers the exploitation of CVE-2025-29775 (impacting xml-crypto)

This exercise covers the exploitation of polyglot token against python_jwt (CVE-2022-39227)

This exercise details how to exploit an application vulnerable to cache poisoning

This exercise details how to exploit an application vulnerable to cache deception

This exercise details how to exploit an application vulnerable to cache deception

This exercise covers the exploitation of a SSRF in PySAML2

This exercise covers the exploitation of algorithm confusion when no public key is available with a ECDSA key

This exercise covers the exploitation of CVE-2021-21239 (PySAML2)

This exercise covers the creation of a malicious IDP to forge an assertion

This exercise covers the exploitation of a Signature Wrapping Issue in passport-saml (CVE-2022-39299)

This exercise covers the exploitation of CVE-2022-21449 against a Java Application relying on JWT

This exercise covers the exploitation of an XSS in an OAuth2 Authorization Server

This exercise covers the exploitation of an XSS in an OAuth2 Authorization Server

This exercise covers the exploitation of algorithm confusion when no public key is available

This exercise covers the exploitation of a comment injection vulnerability in SAML

This exercise covers how to use Signature Wrapping to become an arbitrary user

This exercise covers how to use Signature Wrapping to become an arbitrary user

This exercise covers how to pass the SAMLResponse from one Service Provider to another

This exercise covers the exploitation of a state fixation in an OAuth2 Client