Exercises

This exercise explains how you can exploit CVE-2008-1930 to gain access to the administration interface of a Wordpress installation.

This exercise explains how you can from a SQL injection gain access to the administration console, and from there, how you can run commands on the underlying system

After a short brute force introduction, this exercise explains the tampering of rack cookies and how you can even manage to modify a signed cookie (if the secret is trivial). Using this issue, you will be able to escalate your privileges and gain command execution

This exercise explains how to perform a Linux host review, what and how you can check the configuration of a Linux server to ensure it is securely configured. The reviewed system is a traditional Linux-Apache-Mysql-PHP (LAMP) server used to host a blog.

This exercise explains how you can exploit CVE-2012-2661 to retrieve information from a database

This exercise explains how you can exploit CVE-2012-1823 to retrieve the source code of an application and gain code execution.

This exercise describes the exploitation of a local file include with limited access. Once code execution is gained, you will see some post exploitation tricks.

This exercise demonstrates how to leverage a SQL injection to gain access to the admin console, and from there, how to execute commands on the underlying system