Sign in Create Account

Exercises

Exercise Avg. Time Difficulty Solved by Tier
postMessage() IV
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the Origin and X-Frame-Options is used
 < 1 Hr. medium 1012 PRO
Code Review 01
This exercise is one of our challenges to help you learn how to review real source code
 < 1 Hr. medium 973 PRO
Spring Actuators
This exercise covers how you can gain code execution using Spring Actuators when Spring Cloud is used.
 < 1 Hr. medium 311 PRO
postMessage() III
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to trigger a Cross-Site Scripting
 < 1 Hr. medium 1030 PRO
postMessage() II
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information when a listener does not filter the Origin
 < 1 Hr. medium 1147 PRO
PHP phar://
This exercise covers how the PHP phar:// handler can be used to gain code execution using PHP unserialize.
 < 1 Hr. medium 374 PRO
Signing Oracle
This exercise covers how a signing oracle can be used to bypass authorization in place
 < 1 Hr. easy 868 PRO
Length Extension Attack
This exercise covers how to use a length extension attack to exploit a directory traversal vulnerability
 < 1 Hr. hard 793 PRO
JSON Web Encryption
This exercise covers how you can create your own JWE if you have access to the public key used by the server
 < 1 Hr. medium 565 PRO
postMessage()
This exercise covers how insecure calls to the JavaScript function postMessage() can be used to leak sensitive information
 < 1 Hr. medium 1316 PRO
CVE-2019-5418
This exercise details the exploitation of CVE-2019-5418 to get code execution
 < 1 Hr. hard 529 PRO
Cross-Site WebSocket Hijacking
This exercise covers Cross-Site WebSocket Hijacking and how it can be used to gain access to sensitive information
 < 1 Hr. medium 1142 PRO
JWT XII JWT
This exercise covers how to use the x5u header to bypass an authentication based on JWT.
 < 1 Hr. hard 722 PRO
Cross-Origin Resource Sharing II
This exercise covers Cross-Origin Resource Sharing and how it can be used to get access to sensitive data.
 < 1 Hr. medium 1092 PRO
JWT XI JWT
This exercise covers how to use the jku header to bypass an authentication based on JWT.
 < 1 Hr. hard 716 PRO
cve-2019-5420 II
This exercise details the exploitation of CVE-2019-5420 to gain code execution
 < 1 Hr. hard 589 PRO
OAuth2: Client OpenRedirect
This exercise covers the exploitation of an OpenRedirect in an OAuth2 Client
 < 1 Hr. medium 870 PRO
CVE-2019-5420
This exercise details the exploitation of CVE-2019-5420 to forge a session as another user
 < 1 Hr. medium 944 PRO
JWT X JWT
This exercise covers how to use the jku header to bypass an authentication based on JWT.
 < 1 Hr. hard 813 PRO
GraphQL: SQL Injection
This exercise covers how to use introspection and a SQL injection to get access to additional information in GraphQL.
 < 1 Hr. medium 1525 PRO
OAuth2: Authorization Server OpenRedirect
This exercise covers the exploitation of an OpenRedirect in an OAuth2 Authorization Server
 < 1 Hr. medium 983 PRO
JWT IX JWT
This exercise covers how to use the jku header to bypass an authentication based on JWT.
 < 1 Hr. hard 942 PRO
Gogs RCE II
This exercise covers how to get code execution against the Git self hosted tool: Gogs.
 < 1 Hr. hard 626 PRO
JWT VIII JWT
This exercise covers how to use the jku header to bypass an authentication based on JWT.
 < 1 Hr. hard 1020 PRO
SAML: Signature Stripping
This exercise covers the exploitation of a signature stripping vulnerability in SAML
 < 1 Hr. medium 2197 PRO
GraphQL Introspection
This exercise covers how to use introspection to get access to additional information in GraphQL.
 < 1 Hr. easy 2471 PRO
Gogs RCE
This exercise covers how to get code execution against the Git self hosted tool: Gogs.
 < 1 Hr. hard 702 PRO
Android 07
This exercise will guide you through the process of reversing a simple obfuscated Android code to recover the encrypted data
 < 1 Hr. hard 1510 PRO
Android 06
This exercise will guide you through the process of reversing a simple obfuscated Android code to recover the encrypted data
 < 1 Hr. hard 1770 PRO
Android 08
This exercise will guide you through the process of reversing a simple obfuscated Android code to recover the encrypted data
 < 1 Hr. hard 1432 PRO
‹ 1 … 17 18 19 20 21 22 23 … 27 ›
Showing 571–600 of 805 exercises