A web-focused box exploiting SQLi, SSTI, and RCE techniques through smart injection chaining and filter bypassing.
A PHP box focusing on insecure object merging, SSRF, LFI, and Log Poisioning for privilege escalation and code access.
A social media box focusing on blind XSS, session hijacking, and fetch-based CSRF for privilege escalation and admin access.
This box is focused on a recovery code brute-forcing and JWT exploitation through kid header manipulation and payload tampering, leading to admin privileges and RCE.
The box is focused on SSRF > WebSocket tunneling via crafted 101 response, and an HTTP/2 to HTTP/1.1 desync attack, leading to request hijacking.