Exercises

This challenge is the second in the fastjson @JSONType series. Unlike lab I it runs on a stock Spring Boot app on the latest JDK that parses on the Tomcat request thread with no classloader wiring. A direct jar:http payload only yields SSRF there; remote code execution comes from the two-request /proc/self/fd variant, whose file: class name has no '//', so Tomcat's own webapp classloader defines it on the request thread.

This challenge covers a remote code execution in fastjson 1.2.83 with autoType disabled, by abusing the @JSONType trust probe in ParserConfig.checkAutoType together with a jar:http:// class name loaded through Spring Boot's LaunchedURLClassLoader on JDK 8.

This challenge covers gaining a shell on WordPress by chaining CVE-2026-63030 and CVE-2026-60137.

This challenge covers the review of a CVE in a typescript codebase and its patch

This challenge covers the review of a CVE in a typescript codebase and its patch

This challenge covers the review of a CVE in a typescript codebase and its patch

This exercise covers the exploitation of an RCE in SAML by leveraging a vulnerable version of xmlsec

This exercise covers escaping vm.runInNewContext when specific safe objects are provided but frozen, using Error objects or Promise callbacks.

This exercise covers escaping vm.runInNewContext when the context is created with Object.create(null) so this.constructor is undefined.

This exercise covers bypassing post-2.0 static-eval that blocks member access on functions, using anonymous function bodies.

This exercise covers exploiting the original unpatched static-eval with unrestricted property access on functions.

This exercise covers bypassing static-eval parameter validation using destructured parameters (ObjectPattern).

This challenge covers the review of a CVE in a python codebase and its patch

This challenge covers the review of a CVE in a python codebase and its patch

This exercise covers bypassing AST-based sandbox filtering using computed property access or Reflect.get().