A web challenge about unsafe Python pickle deserialization hidden inside a code editor.

A Python/Jinja2 SSTI challenge using SandboxedEnvironment and CVE-2025-27516.

From a web dashboard to full root access.

A PHP Jail challenge. No alphanumeric characters, only 125 bytes.

This challenge is a continuation of the previous challenge The Gauntlet Pt. 1 This writeup is WIP and may be incomplete. 🗒️ Challenge description So, part two.. gitgud, get root.. 😎 Wri...

🗒️ Challenge description So, you think you’re a l33t h4xx0r? Alright, here’s my little gauntlet to you then: Break in through the website and get a shell one way or another. Once that’s done, es...

This challenge is a continuation of the previous challenge Film til dig Pt. 1 🍿 🧪 Experimental admin powers The second part of the challenge doesn’t have a description. But looking in the Docker...

🗒️ Challenge description 0xlime synes du skal sætte dig ned og se nogle film, der er 2 flag, find film til dig på {endpoint}, husk at dele hvad du synes g This is a Web Exploitation challenge ...