Penetration Testing, Security Code Review and Web App Security Exercises

Free PRO CVE Easy Medium Hard XSS Code Review API SSRF HTTP RECON CSRF SQLi

Exercise	Avg. Time	Solved by	Tier
Web Fundamentals: Cookies	< 1 Hr.	77	PRO
Web Fundamentals: HTML Forms	< 1 Hr.	75	PRO
Web Fundamentals: JSON	< 1 Hr.	69	PRO
Web Fundamentals: HTML	< 1 Hr.	84	PRO
Web Fundamentals: URL Encoding	< 1 Hr.	94	PRO
JS Sandbox: Keyword Blocklist Bypass This exercise covers bypassing indexOf/includes blocklists with bracket notation and string concatenation.	< 1 Hr.	21	PRO
JS Sandbox: Prototype Chain Navigation This exercise covers navigating __proto__, .constructor, and .prototype from a string literal to reach the Function constructor.	< 1 Hr.	28	PRO
JS Sandbox: From Sandbox Escape to RCE This exercise covers the standard Node.js RCE chain: process -> mainModule -> require('child_process') -> execSync.	< 1 Hr.	24	PRO
JS Sandbox: The Function Constructor This exercise covers using Function(...)() as an eval alternative to execute arbitrary code in an app that blocks eval.	< 1 Hr.	23	PRO
CVE-2026-XX762 This challenge covers the review of a CVE in a python codebase and its patch	< 1 Hr.	49	PRO
CVE-2026-XX953 This challenge covers the review of a CVE in a python codebase and its patch	< 1 Hr.	57	PRO
CVE-2026-XX230 This challenge covers the review of a CVE in a python codebase and its patch	< 1 Hr.	49	PRO
CVE-2026-XX928 This challenge covers the review of a CVE in a python codebase and its patch	< 1 Hr.	42	PRO
CVE-2026-XX977 This challenge covers the review of a CVE in a python codebase and its patch	< 1 Hr.	51	PRO
CVE-2023-51XX9 This challenge covers the review of a CVE in a python codebase and its patch	< 1 Hr.	55	PRO
CVE-2026-XX130 This challenge covers the review of a CVE in a python codebase and its patch	< 1 Hr.	57	PRO
CVE-2026-XX790 This challenge covers the review of a CVE in a python codebase and its patch	< 1 Hr.	51	PRO
JWT: Refresh Token Bypass This exercise covers bypassing JWT refresh token validation to maintain unauthorized access.	< 1 Hr.	45	PRO
CVE-2026-2413X This challenge covers the review of a CVE in a python codebase and its patch	< 1 Hr.	53	PRO
CVE-2026-21XX3 This challenge covers the review of a CVE in a Python codebase and its patch	< 1 Hr.	51	PRO
CVE-2023-3X829 This challenge covers the review of a CVE in a Python codebase and its patch	--	69	PRO
CVE-2025-X9X28 This challenge covers the review of a CVE in a typescript codebase and its patch	--	64	PRO
CVE-2025-X23XX This challenge covers the review of a CVE in a javascript codebase and its patch	--	66	PRO
CVE-2024-X170X This challenge covers the review of a CVE in a JavaScript codebase and its patch	--	79	PRO
CVE-2026-XX951 This challenge covers the review of a CVE in a javascript codebase and its patch	--	76	PRO
CVE-2025-XX662 This challenge covers the review of a CVE in a python codebase and its patch	--	70	PRO
CVE-2026-X189X This challenge covers the review of a CVE in a python codebase and its patch	< 1 Hr.	73	PRO
CVE-2025-625X8 This challenge covers the review of a CVE in a javascript codebase and its patch	--	86	PRO
CVE-2025-XX953 This challenge covers the review of a CVE in a typescript codebase and its patch	--	80	PRO
CVE-2026-XX871 This challenge covers the review of a CVE in a python codebase and its patch	--	71	PRO

‹ 1 2 3 4 5 … 25 ›

Showing 31–60 of 743 exercises