Exercises
| Exercise | Avg. Time | Difficulty | Solved by | Tier | |
|---|---|---|---|---|---|
|
Recon 21
In this challenge, you need to look at the information in the branches for repo4
|
< 1 Hr. |  |
5461 | FREE |
|
|
Recon 22
In this challenge, you need to look in repo9 for deleted files
|
< 1 Hr. |  |
5249 | FREE |
|
|
Recon 23
In this challenge, you need to look for sensitive information in commit messages
|
< 1 Hr. | |
5228 | FREE |
|
SAML: SAMLResponse forwarding
This exercise covers how to pass the SAMLResponse from one Service Provider to another
|
< 1 Hr. | |
545 | PRO |
|
|
CGI and Signature
This exercise covers the exploitation of a vulnerable CGI.
|
< 1 Hr. | |
239 | PRO |
|
|
Recon 17
In this challenge, you need to look at the name of the developer used in the repository test1
|
< 1 Hr. | |
5940 | FREE |
|
|
Recon 18
In this challenge, you need to look at the public repository of the developers in the organisation
|
< 1 Hr. | |
5623 | FREE |
|
|
Recon 19
In this challenge, you need to look at the email addresses used for commits in the repository repo7
|
< 1 Hr. | |
5299 | FREE |
|
Code Review 15
This exercise is one of our challenges to help you learn how to review real source code
|
< 1 Hr. | |
515 | PRO |
|
|
Code Review 14
This exercise is one of our challenges to help you learn how to review real source code
|
< 1 Hr. | |
541 | PRO |
|
CVE-2020-14343: PyYAML unsafe loader
This exercise covers how you can gain code execution when an application use a vulnerable version of PyYAML and relies on load()
|
< 1 Hr. | |
354 | PRO |
|
|
OAuth2: State Fixation
This exercise covers the exploitation of a state fixation in an OAuth2 Client
|
1-2 Hr. | |
422 | PRO |
|
|
Code Review 13
This exercise is one of our challenges to help you learn how to review real source code
|
1-2 Hr. |  |
452 | PRO |
|
|
CVE-2020-7115: Aruba Clearpass RCE
This exercise covers a remote command execution issue on Aruba Clearpass RCE
|
< 1 Hr. | |
228 | PRO |
|
|
Code Review 12
This exercise is one of our challenges to help you learn how to review real source code
|
< 1 Hr. | |
580 | PRO |
|
|
OAuth2: Predictable State II
This exercise covers the exploitation of a predictable state in an OAuth2 Client
|
1-2 Hr. | |
282 | PRO |
|
|
Recon 13
In this challenge, you need to find the TXT record linked to key.z.hackycorp.com
|
< 1 Hr. | |
6935 | FREE |
|
|
Recon 14
In this challenge, you need to find a TXT record by doing a zone transfer on z.hackycorp.com
|
< 1 Hr. | |
6235 | FREE |
|
|
Recon 15
In this challenge, you need to find a TXT record by doing a zone transfer on the internal zone "int"
|
< 1 Hr. | |
5671 | FREE |
|
|
Recon 16
In this challenge, you need to find the version of Bind used
|
< 1 Hr. | |
5833 | FREE |
|
|
EDDSA vulnerability in Monocypher
Crypto
This exercise covers the exploitation of a vulnerability impacting Monocypher.
|
< 1 Hr. | |
193 | PRO |
|
|
Code Review 11
This exercise is one of our challenges to help you learn how to review real source code
|
2-4 Hr. | |
394 | PRO |
|
|
OAuth2: Predictable State
This exercise covers the exploitation of a predictable state in an OAuth2 Client
|
2-4 Hr. | |
306 | PRO |
|
|
Code Review 10
This exercise is one of our challenges to help you learn how to review real source code
|
< 1 Hr. | |
501 | PRO |
|
|
Recon 11 | < 1 Hr. | |
6355 | FREE |
|
|
Recon 12 | < 1 Hr. | |
6918 | FREE |
|
|
Unicode and NFKC
This exercise covers how to leverage unicode to exploit a directory traversal
|
< 1 Hr. | |
331 | PRO |
|
|
SAML: Trusted Embedded Key
This exercise covers the exploitation of a Service Provider (SP) that doesn't check the certificate provided in the SAMLResponse
|
< 1 Hr. | |
544 | PRO |
|
|
Recon 06
This exercise covers default vhost
|
< 1 Hr. | |
12378 | FREE |
|
|
Recon 07
This exercise covers default TLS vhost
|
< 1 Hr. | |
11258 | FREE |
Showing 451–480 of 753 exercises
Free Labs of the Month
