Penetration Testing, Security Code Review and Web App Security Exercises

Free PRO CVE Easy Medium Hard XSS Code Review API SSRF HTTP RECON CSRF SQLi

Exercise	Avg. Time	Solved by	Tier
JWT Algorithm Confusion JWT This exercise covers the exploitation of an issue with some implementations of JWT	< 1 Hr.	3921	PRO
CVE-2016-0792 This exercise covers the exploitation of an Xstream vulnerability in Jenkins	< 1 Hr.	4911	PRO
ObjectInputStream This exercise covers the exploitation of a call to readObject in a Spring application	< 1 Hr.	4407	PRO
XMLDecoder This exercise covers the exploitation of an application using XMLDecoder	< 1 Hr.	5517	PRO
CVE-2014-1266 This exercise covers how to intercept an HTTPs connection	< 1 Hr.	1083	PRO
CVE-2011-0228 This exercise covers how to intercept an HTTPs connection	< 1 Hr.	1237	PRO
Intercept 03 This exercise covers how to intercept an HTTPs connection with hostname verification.	< 1 Hr.	1518	PRO
Intercept 02 This exercise covers how to intercept an HTTPs connection.	< 1 Hr.	1673	PRO
Intercept 01 This exercise covers how to intercept an HTTP connection.	< 1 Hr.	1848	PRO
Struts devMode This exercise covers how to get code execution when a Struts application is running in devMode		0	PRO
JSON Web Token None Algorithm JWT This exercise covers the exploitation of a signature weakness in a JWT library.	< 1 Hr.	10427	PRO
Cross-Origin Resource Sharing This exercise covers Cross-Origin Resource Sharing and how it can be used to bypass CSRF protection if it's misconfigured		0	PRO
API to Shell API This exercise covers the exploitation of PHP type confusion to bypass a signature and the exploitation of unserialize.	< 1 Hr.	3567	PRO
Pickle Code Execution This exercise covers the exploitation of Python's pickle when used to deserialize untrusted data	< 1 Hr.	6600	PRO

‹ 1 2 3 4 ›

Showing 91–104 of 104 exercises