Exercises

This challenge covers the review of a vulnerability in a python codebase and its patch

This challenge covers the review of a vulnerability in a python codebase and its patch

This challenge covers an unauthenticated remote code execution reproducing MantisBT CVE-2026-49273: a value is validated with eval('return; ...'), but PHP hoists class declarations past the return; at compile time, letting an attacker pre-declare the class the app then autoloads and instantiates.

This challenge is the second in the fastjson @JSONType series. Unlike lab I it runs on a stock Spring Boot app on the latest JDK that parses on the Tomcat request thread with no classloader wiring. A direct jar:http payload only yields SSRF there; remote code execution comes from the two-request /proc/self/fd variant, whose file: class name has no '//', so Tomcat's own webapp classloader defines it on the request thread.

This challenge covers a remote code execution in fastjson 1.2.83 with autoType disabled, by abusing the @JSONType trust probe in ParserConfig.checkAutoType together with a jar:http:// class name loaded through Spring Boot's LaunchedURLClassLoader on JDK 8.

This challenge covers gaining a shell on WordPress by chaining CVE-2026-63030 and CVE-2026-60137.

This challenge covers the review of a CVE in a typescript codebase and its patch

This challenge covers the review of a CVE in a typescript codebase and its patch

This challenge covers the review of a CVE in a typescript codebase and its patch

This exercise covers the exploitation of an RCE in SAML by leveraging a vulnerable version of xmlsec