Challenge

The goal is to brute force an HTTP login page.

Perform command injection using the ping functionality.

Changing the victim’s password using CSRF.

Read the /etc/passwd file using File Inclusion vulnerability.

Exploit the file upload vulnerability to achieve Remote Code Execution (RCE).

Use an SQL injection attack to retrieve the admin password.

Perform a blind SQL injection attack to retrieve the database version.

Identify the cookie session ID pattern.

Trigger an alert pop-up with cookie values using DOM-based XSS.

Trigger an alert pop-up with cookie values using Reflected XSS.