3.1: XSS

Leverage cross-site scripting to attack vulnerable clients
125 min Updated May 29, 2021
Start

3.2: CORS, Content Security Policy

Experiment with headers within HTTP that limit XSS vulnerabilities.
72 min Updated May 21, 2021
Start

3.3: CSRF

Leverage cross-site request forgery to exploit vulnerable web applications
53 min Updated May 29, 2021
Start

3.4: Clickjacking

Leverage unsolicited framing to exploit vulnerable web applications
40 min Updated May 29, 2021
Start

3.5: Insecure Deserialization (PHP)

Leverage a deserialization vulnerability to exploit a PHP web application.
44 min Updated Jun 9, 2021
Start

3.6: Insecure Deserialization (JavaScript)

Leverage a deserialization vulnerability to exploit a NodeJS web application.
53 min Updated May 11, 2021
Start

4.1: Thunder CTF

Play attacker and defender roles in the cloud using several vulnerable cloud deployments.
286 min Updated Jun 1, 2021
Start

4.2: Serverless Goat

Exploit a serverless application to gain unauthorized access to resources of the account that hosts it.
86 min Updated May 14, 2021
Start

4.3: flaws.cloud

Exploit several vulnerable cloud deployments to gain unauthorized access.
82 min Updated May 25, 2021
Start

4.4: flaws2.cloud

Play attacker and defender roles in the cloud using several vulnerable cloud deployments.
73 min Updated May 26, 2021
Start

4.5: CloudGoat

Exploit vulnerable cloud deployments to gain unauthorized access to cloud resources.
73 min Updated May 28, 2021
Start

1.2: Web Programming

Use Python to efficiently access a collection of web sites
48 min Updated Jun 16, 2021
Start

1.4: HW1 (2fa-bypass-using-a-brute-force-attack)

Write a program to brute-force a vulnerable 2FA process
137 min Updated Apr 24, 2021
Start

2.2: HW2 (conditional-responses)

Write a program to perform Blind SQL injection using binary search
161 min Updated Apr 26, 2021
Start

1.3: Broken Authentication

Leverage authentication vulnerabilities to gain unauthorized access to sites.
35 min Updated Jun 16, 2021
Start

1.5: Broken Access Control

Leverage access control vulnerabilities to exploit vulnerable web sites
110 min Updated Apr 19, 2021
Start

1.6: SSRF

Leverage server-side request forgery to exploit vulnerable web applications
23 min Updated Jun 16, 2021
Start

1.7: XXE

Leverage XML eXternal Entities to exploit vulnerable web applications
35 min Updated May 29, 2021
Start

2.1: Command and SQL injection

Leverage command and SQL injection to exploit web applications
55 min Updated May 29, 2021
Start

1.1: Setup

Setup the accounts and virtual machines for use in this course.
76 min Updated Jun 16, 2021
Start

5.1: Tools setup

Setup Kali VMs and web servers to practice using tools that automate reconnaissance, scanning, and exploitation.
63 min Updated Jun 9, 2021
Start

5.2: wfuzz, nmap, bucket-stream

Perform reconnaissance attacks using automated tools.
37 min Updated Jun 5, 2021
Start

5.3: wpscan

Scan WordPress sites for vulnerabilities automatically.
42 min Updated May 30, 2021
Start

5.4: hydra, sqlmap, xsstrike, commix

Identify vulnerabilities in web applications via automated tools.
25 min Updated Jun 2, 2021
Start

5.5: metasploit

Exploit vulnerable web applications using an industry-standard tool.
27 min Updated May 30, 2021
Start
Loading Codelabs, please wait...