Exercises
| Exercise | Avg. Time | Difficulty | Solved by | Tier | |
|---|---|---|---|---|---|
|
Code Review 03
This exercise is one of our challenges to help you learn how to review real source code
|
2-4 Hr. |  |
494 | PRO |
|
SSRF in PDF generation
This exercise covers how you can read arbitrary files when an application generates pdfs from provided links
|
< 1 Hr. |  |
928 | PRO |
|
OAuth2: Github HTTP HEAD
This exercise covers the exploitation of the HTTP HEAD issue impacting Github in 2019
|
< 1 Hr. | |
468 | PRO |
|
SVG XSS
This exercise covers how to use an SVG to trigger a Cross-Site-Scripting
|
< 1 Hr. |  |
1913 | PRO |
|
Apache Pluto RCE
This exercise covers how to gain code execution on Apache Pluto 3.0.0 due to a flaw in the authorization logic
|
< 1 Hr. | |
564 | PRO |
|
JSON Cross-Site Request Forgery
This exercise details the exploitation of a Cross-Site Request Forgery when JSON is used
|
< 1 Hr. | |
1529 | PRO |
|
|
Cross-Site Request Forgery
This exercise details the exploitation of a Cross-Site Request Forgery to gain access to sensitive data
|
< 1 Hr. | |
1572 | PRO |
|
|
Code Review 02
This exercise is one of our challenges to help you learn how to review real source code
|
1-2 Hr. | |
677 | PRO |
|
|
postMessage() IV
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the Origin and X-Frame-Options is used
|
< 1 Hr. | |
1002 | PRO |
|
|
Code Review 01
This exercise is one of our challenges to help you learn how to review real source code
|
1-2 Hr. | |
945 | PRO |
|
|
Spring Actuators
This exercise covers how you can gain code execution using Spring Actuators when Spring Cloud is used.
|
1-2 Hr. | |
302 | PRO |
|
|
postMessage() III
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to trigger a Cross-Site Scripting
|
< 1 Hr. | |
1019 | PRO |
|
|
postMessage() II
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the Origin
|
< 1 Hr. | |
1131 | PRO |
|
|
PHP phar://
This exercise covers how the PHP phar:// handler can be used to gain code execution using PHP unserialize.
|
< 1 Hr. | |
366 | PRO |
|
|
Signing Oracle
This exercise covers how a signing oracle can be used to bypass authorization in place
|
< 1 Hr. | |
859 | PRO |
|
|
Length Extension Attack
This exercise covers how to use a length extension attack to exploit a directory traversal vulnerability
|
1-2 Hr. | |
789 | PRO |
|
|
JSON Web Encryption
This exercise covers how you can create your own JWE if you have access to the public key used by the server
|
< 1 Hr. | |
554 | PRO |
|
|
postMessage()
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information
|
< 1 Hr. | |
1293 | PRO |
|
|
CVE-2019-5418
This exercise details the exploitation of CVE-2019-5418 to get code execution
|
1-2 Hr. | |
526 | PRO |
|
|
Cross-Site WebSocket Hijacking
This exercise covers Cross-Site WebSocket Hijacking and how it can be used to gain access to sensitive information
|
< 1 Hr. | |
1123 | PRO |
|
|
JWT XII
JWT
This exercise covers how to use the x5u header to bypass an authentication based on JWT.
|
1-2 Hr. | |
712 | PRO |
|
|
Cross-Origin Resource Sharing II
This exercise covers Cross-Origin Resource Sharing and how it can be used to get access to sensitive data.
|
< 1 Hr. | |
1077 | PRO |
|
|
JWT XI
JWT
This exercise covers how to use the jku header to bypass an authentication based on JWT.
|
1-2 Hr. | |
706 | PRO |
|
|
cve-2019-5420 II
This exercise details the exploitation of CVE-2019-5420 to gain code execution
|
1-2 Hr. | |
586 | PRO |
|
|
OAuth2: Client OpenRedirect
This exercise covers the exploitation of an OpenRedirect in an OAuth2 Client
|
< 1 Hr. | |
855 | PRO |
|
|
CVE-2019-5420
This exercise details the exploitation of CVE-2019-5420 to forge a session as another user
|
2-4 Hr. | |
937 | PRO |
|
|
JWT X
JWT
This exercise covers how to use the jku header to bypass an authentication based on JWT.
|
< 1 Hr. | |
800 | PRO |
|
|
GraphQL: SQL Injection
This exercise covers how to use introspection and a SQL injection to get access to additional information in GraphQL.
|
1-2 Hr. | |
1513 | PRO |
|
|
OAuth2: Authorization Server OpenRedirect
This exercise covers the exploitation of an OpenRedirect in an OAuth2 Authorization Server
|
< 1 Hr. | |
967 | PRO |
|
|
JWT IX
JWT
This exercise covers how to use the jku header to bypass an authentication based on JWT.
|
< 1 Hr. | |
931 | PRO |
Showing 511–540 of 753 exercises
Free Labs of the Month
