Blue Badge

This badge is an extension of the yellow badge and covers complex attacks

11

Exercises

145

Completed this badge

13

CPEs

S2-052

This exercise covers the exploitation of the Struts S2-052 vulnerability

Difficulty: EASY
  • Java/Struts
  • Completed by 409 students
  • Takes Less than an hour on average

JWT VII

This exercise covers the exploitation of a website using JWT for session without verifying the signature

Difficulty: EASY
  • Completed by 407 students
  • Takes Less than an hour on average

Git Information Leak

This exercise details how to retrieve information from an exposed .git directory on a web server

Difficulty: EASY
  • 1 video
  • Completed by 482 students
  • Takes Less than an hour on average

JWT V

This exercise covers the exploitation of a trivial secret used to sign JWT tokens.

Difficulty: EASY
  • 1 video
  • Completed by 386 students
  • Takes Less than an hour on average

Git Information Leak II

This exercise details how to retrieve information from an exposed .git directory on a web server. This time, the directly listing is disabled

Difficulty: EASY
  • Completed by 322 students
  • Takes Less than an hour on average

JWT III

This exercise covers the exploitation of an issue in the usage of JWT token

Difficulty: MEDIUM
  • 1 video
  • Completed by 322 students
  • Takes Between 2 and 4 hours on average

JWT IV

This exercise covers the exploitation of a vulnerability similar to the recent CVE-2017-17405 impacting Ruby Net::FTP

Difficulty: MEDIUM
  • 1 video
  • Completed by 301 students
  • Takes Less than an hour on average

JWT VI

This exercise covers the exploitation of an injection in the kid element of a JWT. This injection can be used to bypass the signature mechanism

Difficulty: MEDIUM
  • 1 video
  • Completed by 271 students
  • Takes Between 1 and 2 hours on average

CBC-MAC II

This exercise covers the exploitation of an application using CBC-MAC when an attacker has control over the IV

Difficulty: MEDIUM
  • 1 video
  • Completed by 183 students
  • Takes Between 1 and 2 hours on average

CBC-MAC

This exercise covers the exploitation of signature of non-fixed size messages with CBC-MAC

Difficulty: HARD
  • 2 videos
  • Completed by 176 students
  • Takes Between 2 and 4 hours on average

CVE-2018-0114

This exercise details the exploitation of a vulnerability in Cisco's node-jose, a JavaScript library created to manage JWT

Difficulty: HARD
  • 1 video
  • Completed by 193 students
  • Takes Between 2 and 4 hours on average