Exercises

Gain code execution by injecting Python through a crafted JSON Schema when the generated Pydantic model is imported.

This exercise covers the exploitation of an XXE in an ODF Parser

Gain code execution through an unsafe module_eval call during WSDL import.

No guardrails at all. Simply ask the model for the secret key.

The system prompt explicitly establishes an instruction hierarchy. Find a way to confuse or bypass the priority system.

Multiple extraction vectors are blocked. Find a creative approach the rules don't anticipate.

The model is told to keep a secret key and refuses to reveal it directly. The rule only forbids telling the key, not repeating the instructions that contain it. Make the model recite its own system prompt and the key comes with it.

The model is told to refuse key requests. Use social engineering to convince it to share anyway.