Exercises
| Exercise | Avg. Time | Difficulty | Solved by | Tier | |
|---|---|---|---|---|---|
|
Recon 16
In this challenge, you need to find the version of Bind used
|
< 1 Hr. |  |
5712 | FREE |
|
EDDSA vulnerability in Monocypher
Crypto
This exercise covers the exploitation of a vulnerability impacting Monocypher.
|
< 1 Hr. | |
191 | PRO |
|
Code Review 11
This exercise is one of our challenges to help you learn how to review real source code
|
2-4 Hr. |  |
380 | PRO |
|
|
OAuth2: Predictable State
This exercise covers the exploitation of a predictable state in an OAuth2 Client
|
2-4 Hr. | |
302 | PRO |
|
|
Code Review 10
This exercise is one of our challenges to help you learn how to review real source code
|
< 1 Hr. | |
489 | PRO |
|
|
Recon 11 | < 1 Hr. |  |
6207 | FREE |
|
|
Recon 12 | < 1 Hr. | |
6771 | FREE |
|
|
Unicode and NFKC
This exercise covers how to leverage unicode to exploit a directory traversal
|
< 1 Hr. | |
328 | PRO |
|
|
SAML: Trusted Embedded Key
This exercise covers the exploitation of a Service Provider (SP) that doesn't check the certificate provided in the SAMLResponse
|
< 1 Hr. | |
536 | PRO |
|
|
Recon 06
This exercise covers default vhost
|
< 1 Hr. | |
12089 | FREE |
|
|
Recon 07
This exercise covers default TLS vhost
|
< 1 Hr. | |
10989 | FREE |
|
|
Recon 08
This exercise covers aliases in TLS certificates
|
< 1 Hr. | |
9971 | FREE |
|
|
Recon 09 | < 1 Hr. | |
10611 | FREE |
|
CVE-2020-8163: Rails local name RCE
This exercise details the exploitation of CVE-2020-8163 to gain code execution
|
1-2 Hr. | |
230 | PRO |
|
|
SAML: Known Key
This exercise covers the exploitation of a known key in SAML
|
1-2 Hr. | |
550 | PRO |
|
|
Code Review 09
This exercise is one of our challenges to help you learn how to review real source code
|
1-2 Hr. | |
421 | PRO |
|
|
Recon 04
This exercise covers common interesting directories
|
< 1 Hr. | |
16940 | FREE |
|
|
Recon 05
This exercise covers simple directory bruteforcing
|
< 1 Hr. | |
12369 | FREE |
|
|
Recon 01
This exercise covers 404 error pages
|
< 1 Hr. | |
22219 | FREE |
|
OAuth2: Client Server XSS
This exercise covers the exploitation of a Cross-Site Scripting in an OAuth2 Client and Server
|
1-2 Hr. | |
381 | PRO |
|
|
Zip symlink
This exercise covers how you can create a malicious Zip file and use it to gain access to sensitive files.
|
< 1 Hr. | |
603 | PRO |
|
|
Code Review 08
This exercise is one of our challenges to help you learn how to review real source code
|
1-2 Hr. | |
534 | PRO |
|
|
SAML: Comment Injection
This exercise covers the exploitation of a comment injection vulnerability in SAML
|
< 1 Hr. | |
1742 | PRO |
|
|
Unicode and Downcase
This exercise covers how you can use unicode to gain access to an admin account.
|
< 1 Hr. | |
610 | PRO |
|
|
Code Review 07
This exercise is one of our challenges to help you learn how to review real source code
|
1-2 Hr. | |
447 | PRO |
|
|
Recon 10
This exercise covers visual content discovery
|
< 1 Hr. | |
6779 | FREE |
|
|
Recon 00
This exercise covers the robots.txt file
|
< 1 Hr. | |
22215 | FREE |
|
|
Recon 02
This exercise covers the security.txt file
|
< 1 Hr. | |
18739 | FREE |
|
|
Recon 03
This exercise covers directory listing
|
< 1 Hr. | |
16793 | FREE |
|
|
Java Serialize 01
This exercise is one of our challenges to help you learn Java Serialisation exploitation
|
< 1 Hr. | |
441 | PRO |
Showing 451–480 of 734 exercises
Free Labs of the Month
