Web Application Hacking Challenges Pack
$19.99
15 self-contained vulnerable web challenges (Flask + Dockerfile + SOLUTION.json): union, blind boolean and time-based SQLi, stored/reflected XSS, Jinja2 SSTI, basic and blind command injection, SSRF (incl. file://), IDOR, pickle deserialization, JWT alg:none, XXE (lxml DTD) and unrestricted upload.
Key Features
- • 15 challenges with app.py + Dockerfile + requirements + solution
- • Verified in this build: union SQLi (flag), blind boolean oracle, SSTI ({{7*7}} → 49),
- cmdi (;id → uid), pickle admin flag, XXE (file:///etc/hostname), JWT none flag, SSRF file://
- • Generator: list / all / generate <name>
Requirements
- Python 3 + Flask (or Docker).
Changelog
- v3.0 — 6 → 15 challenges, all with verified exploits.
Package Contents
Exact contents of the download archive (2 files):
| README.md | 1,641 B |
| web_challenges.py | 20,157 B |
Related Tools
Training & Courses
Buffer Overflow Lab — Stack Smashing 101
Training & Courses
Active Directory Attack Path Lab
Training & Courses
Red Team Operations Playbook
Training & Courses