Exercises
| Exercise | Avg. Time | Difficulty | Solved by | Tier | |
|---|---|---|---|---|---|
|
CVE-2025-XX95X
This challenge is part of our go code review challenges designed to teach you security code review by reviewing patches
|
< 1 Hr. |  |
101 | PRO |
|
|
CVE-2024-6X3X
This challenge covers the review of a CVE (original vulnerable code and diff) of a real go codebase
|
< 1 Hr. | |
90 | PRO |
|
SAML: CVE-2025-29775
This exercise covers the exploitation of CVE-2025-29775 (impacting xml-crypto)
|
1-2 Hr. | |
23 | PRO |
|
|
CVE-2022-37X1
This challenge covers the review of a CVE in a go codebase and its patch
|
< 1 Hr. | |
112 | PRO |
|
UUIDv1 IDOR | 1-2 Hr. |  |
228 | PRO |
|
|
CVE-2023-XX463
This challenge covers the review of a CVE in a Go codebase and its patch
|
-- | |
108 | PRO |
|
|
Golang Code Review #04
This challenge covers the review of a snippet of code written in Golang.
|
-- | |
148 | PRO |
|
API Mass-Assignment 03 | < 1 Hr. | |
451 | PRO |
|
|
API Mass-Assignment 01 | < 1 Hr. | |
512 | PRO |
|
|
API Mass-Assignment 02 | < 1 Hr. | |
484 | PRO |
|
|
Mongo IDOR III | < 1 Hr. | |
256 | PRO |
|
|
Mongo IDOR IV | 2-4 Hr. | |
151 | PRO |
|
|
CVE-2024-X5X87
This challenge covers the review of a CVE in a go codebase and its patch
|
-- | |
111 | PRO |
|
|
API JWT REVOCATION
JWT
This exercise covers how to bypass a weak JWT Revocation Mechanism.
|
< 1 Hr. |  |
501 | PRO |
|
|
CVE-2022-XX975
This challenge covers the review of a CVE in a Go codebase and its patch
|
< 1 Hr. | |
116 | PRO |
|
|
Puzzle 07
Leverage a weak implementation of lowercase to access arbitrary files
|
1-2 Hr. | |
26 | PRO |
|
|
Puzzle 06
Leverage a weak implementation of lowercase to access arbitrary files
|
< 1 Hr. | |
28 | PRO |
|
|
API 20
This exercise covers how to exploit an authorization issue in an API.
|
< 1 Hr. | |
546 | PRO |
|
|
API 19
This exercise covers how to exploit an authorization issue in an API.
|
< 1 Hr. | |
563 | PRO |
|
|
API 18
This exercise covers how to exploit an authorization issue in an API.
|
< 1 Hr. | |
576 | PRO |
|
|
API 16
This exercise covers how to exploit an authorization issue in an API.
|
< 1 Hr. | |
579 | PRO |
|
|
API 17
This exercise covers how to exploit an authorization issue in an API.
|
< 1 Hr. | |
488 | PRO |
|
|
GraphQL Authorization 02
This exercise covers a simple authorization issue in a GraphQL application.
|
< 1 Hr. | |
456 | PRO |
|
|
GraphQL Authorization 01
This exercise covers a simple authorization issue in a GraphQL application.
|
< 1 Hr. | |
448 | PRO |
|
|
Golang Code Review #03
This challenge covers the review of a snippet of code written in Golang.
|
< 1 Hr. | |
172 | PRO |
|
|
Golang Code Review #01
This challenge covers the review of a snippet of code written in Golang.
|
< 1 Hr. | |
216 | PRO |
|
|
CVE-2024-X90X6
This challenge covers the review of a CVE in a Golang codebase and its patch
|
< 1 Hr. | |
137 | PRO |
|
|
CVE-2022-2X8XX
This challenge covers the review of a CVE in a Golang codebase and its patch
|
< 1 Hr. | |
175 | PRO |
|
|
CVE-2022-X10X8
This challenge covers the review of a CVE in a Golang codebase and its patch
|
1-2 Hr. | |
160 | PRO |
|
|
ORM LEAK: SQLite
This exercise covers how to exploit an ORM leak vulnerability
|
1-2 Hr. | |
167 | PRO |
Showing 121–150 of 753 exercises
Free Labs of the Month
