Media Badge

22 Videos
18 Exercises

The media badge is our set of exercises created to teach you how to abuse applications that allows you to upload or retrieve files in different formats: PDF, Images, Videos and use this behaviour to gain code execution or arbitrary file read

Exercises

Easy
SSRF in PDF generation
  • This exercise covers how you can read arbitrary files when an application generates pdfs from provided links
  • 1 video
  • Completed by 808 students
  • Takes < 1 Hr. on average

 

Coming soon
Easy
ODF XXE
  • This exercise covers the exploitation of an XXE in an ODF Parser
  • Takes -- on average

 

Medium
CVE-2022-39224
  • This exercise covers the exploitation of CVE-2022-39224
  • 1 video
  • Completed by 69 students
  • Takes 2-4 Hrs. on average
  • Ruby
  • CWE-78

 

Medium
XSL PHP
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 232 students
  • Takes < 1 Hr. on average
  • PHP
  • CWE-94,CWE-306

 

Medium
XSL PHP II
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 200 students
  • Takes < 1 Hr. on average
  • PHP
  • CWE-94

 

Medium
DOMPDF RCE
  • This exercise covers the exploitation of a vulnerability in the DOMPDF library
  • 2 videos
  • Completed by 120 students
  • Takes < 1 Hr. on average
  • PHP

 

Medium
XSL PHP IV
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 120 students
  • Takes 2-4 Hrs. on average
  • PHP
  • CWE-94

 

Medium
DOMPDF RCE III
  • This exercise covers the exploitation of a vulnerability in the DOMPDF library
  • 2 videos
  • Completed by 37 students
  • Takes 2-4 Hrs. on average
  • PHP

 

Medium
XSL Java
  • This exercise covers the exploitation of a Java application using XSL
  • 2 videos
  • Completed by 91 students
  • Takes < 1 Hr. on average
  • Java

 

Medium
DOMPDF RCE II
  • This exercise covers the exploitation of a vulnerability in the DOMPDF library
  • 3 videos
  • Completed by 54 students
  • Takes 2-4 Hrs. on average
  • PHP

 

Medium
XSL PHP III
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 144 students
  • Takes < 1 Hr. on average
  • PHP
  • CWE-94

 

Medium
CVE-2021-33564 Argument Injection in Ruby Dragonfly
  • This exercise covers how you can get arbitrary file read using CVE-2021-33564 against Refinery CMS
  • Completed by 117 students
  • Takes < 1 Hr. on average
  • CWE-88

 

Medium
CVE-2021-22204: Exiftool RCE II
  • This exercise covers how you can gain code execution when an application uses exiftool on user-controlled files
  • Completed by 63 students
  • Takes < 1 Hr. on average
  • CWE-94,CWE-74

 

Medium
SSRF via FFMPEG
  • This exercise covers how you can read arbitrary files when an application uses ffmpeg to render videos from a video you provide
  • Completed by 220 students
  • Takes < 1 Hr. on average
  • Ruby/FFMpeg
  • CWE-918

 

Hard
SSRF via FFMPEG II
  • This exercise covers how you can read arbitrary files when an application uses ffmpeg to render videos from a video you provide
  • Completed by 109 students
  • Takes < 1 Hr. on average
  • Ruby/FFMpeg
  • CWE-918

 

Hard
XSL PHP V
  • This exercise covers the exploitation of a PHP application using XSL
  • 2 videos
  • Completed by 92 students
  • Takes < 1 Hr. on average
  • PHP
  • CWE-94

 

Hard
CVE-2021-22204: Exiftool RCE
  • This exercise covers how you can gain code execution when an application uses exiftool on user-controlled files
  • 1 video
  • Completed by 157 students
  • Takes 1-2 Hrs. on average
  • CWE-74

 

Hard
DOMPDF RCE IV
  • This exercise covers the automation of the exploitation of a vulnerability in the DOMPDF library
  • Completed by 18 students
  • Takes > 4 Hrs. on average
  • PHP