web-security

Analysis is a Windows machine running Active Directory. An internal subdomain hosts a webpage vulnerable to LDAP injection, which can be…

Monitored is a Linux machine running an instance of Nagios XI. A username and password for Nagios can be discovered from SNMP data, which…

Blurry is a Linux machine running an application with a vulnerable version of ClearML, which contains a deserialization flaw (CVE-2024-2459…

Builder is a Linux machine running a version of Jenkins with an arbitrary file read vulnerability via the CLI (CVE-2024-23897). This…

Aero is a Windows machine hosting a website that allows users to upload custom Windows 11 themes. Due to a known RCE vulnerability in…

Visual is a Windows machine hosting a website that compiles Visual Studio projects from a remote Git repository. Command execution on the…

Cronos is a Linux machine hosting a website with an admin subdomain that contains a login form with a SQL injection vulnerability. After…

Topology is a Linux machine hosting a website with a PNG image generator based on LaTeX inline math mode commands. This feature can be…

Inject is a Linux machine hosting a cloud storage and collaboration app built with Java and the Spring framework. A route on the app has a…

MonitorsTwo is a Linux machine with a web application that uses Cacti, a web based monitoring and fault management framework. The version of…

Busqueda is a Linux machine featuring a web application that provides users with a URL for a variety of search engines across the web with…

PC is a Linux machine with an open port running gRPC (Google Remote Procedure Call). Interaction with the server using allows for the…

TwoMillion is a Linux machine hosting a web application with an API that has a command injection vulnerability. This vulnerability can be…

Diogenes' Rage is a web challenge featuring a vending machine application that enables users to purchase items using a coupon worth $1.0…