8.1: flaws.cloud

Exploit several vulnerable cloud deployments to gain unauthorized access.
77 min Updated Mar 15, 2024
Start

8.2: flaws2.cloud

Play attacker and defender roles in the cloud using several vulnerable cloud deployments.
73 min Updated Mar 11, 2024
Start

8.3: Serverless Goat

Exploit a serverless application to gain unauthorized access to resources of the account that hosts it.
68 min Updated Mar 13, 2024
Start

8.4: CloudGoat

Exploit vulnerable cloud deployments to gain unauthorized access to cloud resources.
73 min Updated Mar 14, 2024
Start

4.1: XSS

Leverage cross-site scripting to attack vulnerable clients
174 min Updated Feb 20, 2024
Start

4.2: CORS, Content Security Policy

Experiment with headers within HTTP that limit XSS vulnerabilities.
72 min Updated Feb 20, 2024
Start

5.1: CSRF

Leverage cross-site request forgery to exploit vulnerable web applications
53 min Updated Feb 20, 2024
Start

5.2: Clickjacking, Web Cache Poisoning

Leverage unsolicited framing and web cache poisoning to exploit vulnerable web applications
50 min Updated Feb 22, 2024
Start

5.3: Insecure Deserialization (PHP)

Leverage a deserialization vulnerability to exploit a PHP web application.
43 min Updated Feb 28, 2024
Start

5.4: Insecure Deserialization (JavaScript)

Leverage a deserialization vulnerability to exploit a NodeJS web application.
55 min Updated May 9, 2024
Start

5.5: Web Socket Vulnerabilities

Leverage vulnerabilities in web socket use
10 min Updated Feb 20, 2024
Start

7.1: Cloud Setup

Setup accounts on a cloud provider for the course.
30 min Updated Feb 6, 2023
Start

7.2: Thunder CTF

Play attacker and defender roles in the cloud using several vulnerable cloud deployments.
186 min Updated Mar 29, 2024
Start

7.3: Thunder CTF Defender

Play defender in the cloud using a compromised cloud deployment.
75 min Updated Mar 9, 2024
Start

1.2: Web Programming

Use Python to efficiently access a collection of web sites
53 min Updated Jan 9, 2024
Start

1.4: HW1 (2fa-broken-logic)

Write a program to brute-force a vulnerable 2FA process
147 min Updated Jan 23, 2024
Start

3.2: HW2 (conditional-responses)

Write a program to perform Blind SQL injection using binary search
161 min Updated Feb 8, 2024
Start

1.3: Broken Authentication

Leverage authentication vulnerabilities to gain unauthorized access to sites.
70 min Updated Jan 18, 2024
Start

2.1: Broken Access Control

Leverage access control vulnerabilities to exploit vulnerable web sites
243 min Updated Jan 31, 2024
Start

2.2: SSRF

Leverage server-side request forgery to exploit vulnerable web applications
23 min Updated Jan 31, 2024
Start

2.3: XXE

Leverage XML eXternal Entities to exploit vulnerable web applications
35 min Updated Jan 31, 2024
Start

3.1: Command and SQL injection

Leverage command and SQL injection to exploit web applications
55 min Updated Feb 5, 2024
Start

1.1: Setup

Setup the accounts and virtual machines for use in this course.
81 min Updated Feb 19, 2024
Start

6.1: Tools setup

Setup Kali VMs and web servers to practice using tools that automate reconnaissance, scanning, and exploitation.
55 min Updated May 9, 2024
Start

6.2: Discovery tools (Pt 1)

Actively discover potential targets using wfuzz, nmap, bucket-stream, and Google dorking
39 min Updated Feb 26, 2023
Start

6.3: Discovery tools (Pt 2)

Scan WordPress sites for vulnerabilities automatically with wpscan
42 min Updated Mar 5, 2024
Start

6.4: Exploitation tools (Pt 1)

Exploit targets using hydra, sqlmap, xsstrike, commix
25 min Updated May 17, 2024
Start

6.5: Exploitation tools (Pt 2)

Exploit a target using Metasploit
27 min Updated Mar 3, 2024
Start
Loading Codelabs, please wait...