Task 1 What does XSS stand for? Cross-Site Scripting Task 2 Which document property could contain the user’s session token? document.cookie Which JavaScript method is often used as a Proof Of Co...

Task 1 What does SSRF stand for? Server-Side Request Forgery As opposed to a regular SSRF, what is the other type? Blind Task 2 since without & the server was requesting https://server.webs...

Task 1 - What is an IDOR? What does IDOR stand for? Insecure Direct Object Reference Task 2 - An IDOR Example What is the Flag from the IDOR example website? clicking on our order invoice and cha...

Task 3 - Path Traversal What function causes path traversal vulnerabilities in PHP? file_get_contents Task 4 - Local File Inclusion - LFI Give Lab #1 a try to read /etc/passwd. What would the r...

Task 1 - Brief Spin up the machine Task 2 - Username Enumeration the task wants us to do username enumeration, so we need to use endpoint which reveals whether the user provided is a valid user o...

Task 1 - What Is Content Discovery? What is the Content Discovery method that begins with M? Manually What is the Content Discovery method that begins with A? Automated What is the Content Disco...

Task 1 - Walking An Application No answer needed Task 2 - Exploring The Website No answer needed Task 3 - View The Page Source What is the flag from the HTML comment? checking the html source’s...

Task 1 - Brief What is a subdomain enumeration method beginning with B? Brute Force What is a subdomain enumeration method beginning with O? OSINT What is a subdomain enumeration method beginning...

Challenge: transmission.log [Handshake Reuse / Shadow Protocol] Category: Crypto Difficulty: Easy (once you notice the reuse) Flag: CREST{mantis_reused_the_channel@ghost!} Overview This log is ...

This was a small reversing challenge, but it does one useful thing to waste time: it embeds a string that looks like the answer even though that string is only used when the flag is printed. The ac...