Exercises
| Exercise | Avg. Time | Difficulty | Solved by | Tier | |
|---|---|---|---|---|---|
|
JS Sandbox: vm.runInNewContext Null Prototype
This exercise covers escaping vm.runInNewContext when the context is created with Object.create(null) so this.constructor is undefined.
|
< 1 Hr. |  |
35 | PRO |
|
|
JS Sandbox: static-eval Function Property Blocked
This exercise covers bypassing post-2.0 static-eval that blocks member access on functions, using anonymous function bodies.
|
< 1 Hr. | |
34 | PRO |
|
CVE-2026-XX242
This challenge covers the review of a CVE in a python codebase and its patch
|
< 1 Hr. |  |
71 | PRO |
|
|
CVE-2026-XX738
This challenge covers the review of a CVE in a python codebase and its patch
|
< 1 Hr. | |
69 | PRO |
|
|
Web Fundamentals: Introduction | < 1 Hr. | |
291 | PRO |
|
|
JS Sandbox: vm.runInNewContext Empty Context
This exercise covers escaping Node.js vm.runInNewContext with an empty sandbox object via the constructor chain.
|
|
37 | PRO | |
|
|
JS Sandbox: Type Confusion Bypass
This exercise covers bypassing string sanitization by sending an object when the sanitizer expects a string.
|
< 1 Hr. | |
39 | PRO |
|
|
JS Sandbox: Regex Filter Bypass
This exercise covers bypassing regex filters with hex escapes, unicode escapes, or base64 decoding.
|
< 1 Hr. | |
43 | PRO |
|
|
JS Sandbox: AST-Based Filtering
This exercise covers bypassing AST-based sandbox filtering using computed property access or Reflect.get().
|
|
40 | PRO | |
|
|
CVE-2026-XX822
This challenge covers the review of a CVE in a typescript codebase and its patch
|
< 1 Hr. | |
73 | PRO |
|
|
CVE-2024-X7X95
This challenge covers the review of a CVE in a JavaScript codebase and its patch
|
< 1 Hr. | |
56 | PRO |
|
|
CVE-2026-XX292
This challenge covers the review of a CVE in a typescript codebase and its patch
|
|
70 | PRO | |
|
|
CVE-2026-XX27
This challenge covers the review of a CVE in a javascript codebase and its patch
|
|
66 | PRO | |
|
|
CVE-2025-XXXXX
This challenge covers the review of a CVE in a JavaScript codebase and its patch
|
< 1 Hr. | |
62 | PRO |
|
|
Web Fundamentals: Virtual Hosts | < 1 Hr. | |
168 | PRO |
|
|
Web Fundamentals: Content Delivery Network | < 1 Hr. | |
160 | PRO |
|
|
Web Fundamentals: URL Parsing | < 1 Hr. | |
285 | PRO |
|
Web Fundamentals: HTTP | < 1 Hr. | |
243 | PRO |
|
|
Web Fundamentals: Cookies | < 1 Hr. | |
191 | PRO |
|
|
Web Fundamentals: JSON | < 1 Hr. | |
185 | PRO |
|
|
Web Fundamentals: HTML | < 1 Hr. | |
230 | PRO |
|
|
Web Fundamentals: URL Encoding | < 1 Hr. | |
257 | PRO |
|
|
Web Fundamentals: HTML Forms | < 1 Hr. | |
207 | PRO |
|
|
JS Sandbox: The Function Constructor
This exercise covers using Function(...)() as an eval alternative to execute arbitrary code in an app that blocks eval.
|
< 1 Hr. |  |
53 | PRO |
|
|
JS Sandbox: From Sandbox Escape to RCE
This exercise covers the standard Node.js RCE chain: process -> mainModule -> require('child_process') -> execSync.
|
< 1 Hr. | |
54 | PRO |
|
|
JS Sandbox: Keyword Blocklist Bypass
This exercise covers bypassing indexOf/includes blocklists with bracket notation and string concatenation.
|
< 1 Hr. | |
48 | PRO |
|
|
JS Sandbox: Prototype Chain Navigation
This exercise covers navigating __proto__, .constructor, and .prototype from a string literal to reach the Function constructor.
|
< 1 Hr. | |
61 | PRO |
|
|
CVE-2026-XX230
This challenge covers the review of a CVE in a python codebase and its patch
|
< 1 Hr. | |
85 | PRO |
|
|
CVE-2026-XX762
This challenge covers the review of a CVE in a python codebase and its patch
|
< 1 Hr. | |
85 | PRO |
|
|
CVE-2026-XX977
This challenge covers the review of a CVE in a python codebase and its patch
|
< 1 Hr. | |
91 | PRO |
Showing 121–150 of 851 exercises
Free Labs of the Month
