Sign in Create Account

Exercises

Exercise Avg. Time Difficulty Solved by Tier
CVE-2026-24895: FrankenPHP Path Confusion RCE using Unicode 1-2 Hr. hard 3 PRO
Latex: --shell-escape
This exercise covers how one can leverage latex when pdflatex is used with the --shell-escape option to gain command execution.
 < 1 Hr. medium 21 PRO
CVE-2022-24720
This exercise covers how one can leverage image processing in ActiveStorage to gain command execution.
 1-2 Hr. medium 15 PRO
CVE-2024-47081 < 1 Hr. medium 21 PRO
SAML: CVE-2025-25291
This exercise covers the exploitation of CVE-2025-25291 (impacting ruby-saml)
 2-4 Hr. hard 11 PRO
SAML: CVE-2025-29775 Signed Metadata
This exercise covers the exploitation of CVE-2025-29775 (impacting xml-crypto) without XMLResponse
 2-4 Hr. hard 8 PRO
SAML: CVE-2025-29775
This exercise covers the exploitation of CVE-2025-29775 (impacting xml-crypto)
 1-2 Hr. hard 16 PRO
JSON Web Token XV: CVE-2022-39227 JWT
This exercise covers the exploitation of polyglot token against python_jwt (CVE-2022-39227)
 < 1 Hr. hard 35 PRO
Cache Poisoning 01
This exercise details how to exploit an application vulnerable to cache poisoning
 < 1 Hr. medium 127 PRO
Cache Deception 02
This exercise details how to exploit an application vulnerable to cache deception
 < 1 Hr. medium 125 PRO
Cache Deception 01
This exercise details how to exploit an application vulnerable to cache deception
 < 1 Hr. medium 151 PRO
SAML: PySAML2 SSRF
This exercise covers the exploitation of a SSRF in PySAML2
 < 1 Hr. medium 251 PRO
JWT Algorithm Confusion with ECDSA Public Key Recovery JWT
This exercise covers the exploitation of algorithm confusion when no public key is available with a ECDSA key
 1-2 Hr. hard 38 PRO
SAML: CVE-2021-21239
This exercise covers the exploitation of CVE-2021-21239 (PySAML2)
 1-2 Hr. medium 117 PRO
SAML: Malicious IDP
This exercise covers the creation of a malicious IDP to forge an assertion
 2-4 Hr. medium 59 PRO
SAML: Signature Wrapping III
This exercise covers the exploitation of a Signature Wrapping Issue in passport-saml (CVE-2022-39299)
 1-2 Hr. medium 173 PRO
CVE-2022-21449 JWT
This exercise covers the exploitation of CVE-2022-21449 against a Java Application relying on JWT
 < 1 Hr. medium 169 PRO
OAuth2: Authorization Server XSS II
This exercise covers the exploitation of an XSS in an OAuth2 Authorization Server
 < 1 Hr. hard 281 PRO
OAuth2: Authorization Server XSS
This exercise covers the exploitation of an XSS in an OAuth2 Authorization Server
 < 1 Hr. medium 386 PRO
JWT Algorithm Confusion with RSA Public Key Recovery JWT
This exercise covers the exploitation of algorithm confusion when no public key is available
 < 1 Hr. hard 211 PRO
SAML: Comment Injection II
This exercise covers the exploitation of a comment injection vulnerability in SAML
 < 1 Hr. medium 617 PRO
SAML: Signature Wrapping II
This exercise covers how to use Signature Wrapping to become an arbitrary user
 < 1 Hr. hard 460 PRO
SAML: Signature Wrapping
This exercise covers how to use Signature Wrapping to become an arbitrary user
 < 1 Hr. hard 558 PRO
SAML: SAMLResponse forwarding
This exercise covers how to pass the SAMLResponse from one Service Provider to another
 < 1 Hr. medium 523 PRO
OAuth2: State Fixation
This exercise covers the exploitation of a state fixation in an OAuth2 Client
 1-2 Hr. medium 413 PRO
OAuth2: Predictable State II
This exercise covers the exploitation of a predictable state in an OAuth2 Client
 1-2 Hr. hard 277 PRO
OAuth2: Predictable State
This exercise covers the exploitation of a predictable state in an OAuth2 Client
 2-4 Hr. hard 299 PRO
SAML: Trusted Embedded Key
This exercise covers the exploitation of a Service Provider (SP) that doesn't check the certificate provided in the SAMLResponse
 < 1 Hr. medium 509 PRO
SAML: Known Key
This exercise covers the exploitation of a known key in SAML
 1-2 Hr. medium 530 PRO
OAuth2: Client Server XSS
This exercise covers the exploitation of a Cross-Site Scripting in an OAuth2 Client and Server
 1-2 Hr. hard 378 PRO
‹ 1 2 3 4 ›
Showing 1–30 of 97 exercises