Sign in Create Account

Exercises

Exercise Avg. Time Difficulty Solved by Tier
CVE-2026-24895: FrankenPHP Path Confusion RCE using Unicode 1-2 Hr. hard 3 PRO
SAML: CVE-2025-25291
This exercise covers the exploitation of CVE-2025-25291 (impacting ruby-saml)
 2-4 Hr. hard 11 PRO
SAML: CVE-2025-29775 Signed Metadata
This exercise covers the exploitation of CVE-2025-29775 (impacting xml-crypto) without XMLResponse
 2-4 Hr. hard 8 PRO
SAML: CVE-2025-29775
This exercise covers the exploitation of CVE-2025-29775 (impacting xml-crypto)
 1-2 Hr. hard 16 PRO
JSON Web Token XV: CVE-2022-39227 JWT
This exercise covers the exploitation of polyglot token against python_jwt (CVE-2022-39227)
 < 1 Hr. hard 35 PRO
JWT Algorithm Confusion with ECDSA Public Key Recovery JWT
This exercise covers the exploitation of algorithm confusion when no public key is available with a ECDSA key
 1-2 Hr. hard 38 PRO
OAuth2: Authorization Server XSS II
This exercise covers the exploitation of an XSS in an OAuth2 Authorization Server
 < 1 Hr. hard 281 PRO
JWT Algorithm Confusion with RSA Public Key Recovery JWT
This exercise covers the exploitation of algorithm confusion when no public key is available
 < 1 Hr. hard 211 PRO
SAML: Signature Wrapping II
This exercise covers how to use Signature Wrapping to become an arbitrary user
 < 1 Hr. hard 460 PRO
SAML: Signature Wrapping
This exercise covers how to use Signature Wrapping to become an arbitrary user
 < 1 Hr. hard 558 PRO
OAuth2: Predictable State II
This exercise covers the exploitation of a predictable state in an OAuth2 Client
 1-2 Hr. hard 277 PRO
OAuth2: Predictable State
This exercise covers the exploitation of a predictable state in an OAuth2 Client
 2-4 Hr. hard 299 PRO
OAuth2: Client Server XSS
This exercise covers the exploitation of a Cross-Site Scripting in an OAuth2 Client and Server
 1-2 Hr. hard 378 PRO
OAuth2: Github HTTP HEAD
This exercise covers the exploitation of the HTTP HEAD issue impacting Github in 2019
 < 1 Hr. hard 463 PRO
JWT XII JWT
This exercise covers how to use the x5u header to bypass an authentication based on JWT.
 1-2 Hr. hard 696 PRO
JWT XI JWT
This exercise covers how to use the jku header to bypass an authentication based on JWT.
 1-2 Hr. hard 690 PRO
JWT X JWT
This exercise covers how to use the jku header to bypass an authentication based on JWT.
 < 1 Hr. hard 784 PRO
JWT IX JWT
This exercise covers how to use the jku header to bypass an authentication based on JWT.
 < 1 Hr. hard 910 PRO
Gogs RCE II
This exercise covers how to get code execution against the Git self hosted tool: Gogs.
 < 1 Hr. hard 609 PRO
JWT VIII JWT
This exercise covers how to use the jku header to bypass an authentication based on JWT.
 1-2 Hr. hard 987 PRO
Gogs RCE
This exercise covers how to get code execution against the Git self hosted tool: Gogs.
 1-2 Hr. hard 681 PRO
Android 07
This exercise will guide you through the process of reversing a simple obfuscated Android code to recover the encrypted data
 1-2 Hr. hard 1468 PRO
Android 08
This exercise will guide you through the process of reversing a simple obfuscated Android code to recover the encrypted data
 1-2 Hr. hard 1392 PRO
Android 06
This exercise will guide you through the process of reversing a simple obfuscated Android code to recover the encrypted data
 < 1 Hr. hard 1711 PRO
From SQL injection to Shell III SQL Injection
This exercise covers how to gain access to an administration interface using SQL injection followed by how to get command execution using ImageTragick
 1-2 Hr. hard 1138 PRO
IDOR to Shell
This exercise covers how to get code execution by chaining vulnerabilities in a Ruby-on-Rails application
 1-2 Hr. hard 1074 PRO
ECDSA Crypto
This exercise covers the exploitation of a weakness in the usage of ECDSA
 2-4 Hr. hard 362 PRO
Unickle
This challenge was written for Ruxcon CTF 2015. It's an SQL injection mixed with a remote code execution.
 1-2 Hr. hard 670 PRO
Luhn
This challenge was written for Ruxcon CTF 2015. It's an SQL injection with a twist
 2-4 Hr. hard 627 PRO
CVE-2014-1266
This exercise covers how to intercept an HTTPs connection
 1-2 Hr. hard 1078 PRO
‹ 1 2 ›
Showing 1–30 of 32 exercises