Web Application Red Teaming

Advanced web attack chains: SSTI, SSRF, deserialisation and other server-side techniques used on real engagements.

19 rooms, about 2 hours of reading

Start at room 1 Breaking Crypto the Simple Way: RSA to AES bit-flip
  1. 1 Breaking Crypto the Simple Way: RSA to AES bit-flip TryHackMe Breaking Crypto the Simple Way walkthrough: RSA weak key factoring, HMAC dictionary attack, AES-CBC brute force, and … 7 min
  2. 2 Length Extension Attacks: SHA-256 forging and escalation TryHackMe Length Extension Attacks walkthrough: SHA-256 internal state recovery, forged file signatures, cookie role escalation, … 7 min
  3. 3 Attacking ECB Oracles: chosen-plaintext secret recovery TryHackMe Attacking ECB Oracles walkthrough: AES-ECB chosen-plaintext attack, block size and offset determination, byte-by-byte … 7 min
  4. 4 Padding Oracles: AES-CBC byte-by-byte decryption TryHackMe Padding Oracles walkthrough: PKCS7 padding, AES-CBC encryption and decryption, padding oracle attack theory, and … 7 min
  5. 5 CAPTCHApocalypse: automated CAPTCHA brute-force TryHackMe CAPTCHApocalypse walkthrough: RSA-encrypted login brute-force with automated Tesseract OCR CAPTCHA solving, per-request … 5 min
  6. 6 Custom Tooling Using Python: brute-force to RCE TryHackMe Custom Tooling Using Python walkthrough: brute-force login, vulnerability scanning, RCE exploit, and task automation … 7 min
  7. 7 Custom Tooling using Burp: AES-CBC brute-force TryHackMe Custom Tooling using Burp walkthrough: building Burp extensions for AES-CBC brute-force, ROT13 encoding, and RSA-signed … 7 min
  8. 8 Tooling via Browser Automation: Selenium and Playwright TryHackMe Tooling via Browser Automation walkthrough: Selenium CSRF bypass, Tesseract CAPTCHA solving, Playwright with OWASP ZAP … 7 min
  9. 9 Chaining Vulnerabilities: XSS to admin takeover TryHackMe Chaining Vulnerabilities walkthrough: combining default credentials, stored XSS, and CSRF to chain a full admin account … 7 min
  10. 10 Extract: gopher SSRF to middleware bypass TryHackMe Extract walkthrough: gopher SSRF through preview.php, CVE-2025-29927 Next.js middleware bypass, PHP serialized cookie … 5 min
  11. 11 Voyage: container escape via kernel module TryHackMe Voyage walkthrough: Joomla CVE-2023-23752 info leak, pickle deserialization RCE, and Docker container escape via … 4 min
  12. 12 Sequence: stored XSS to Docker socket escape TryHackMe Sequence walkthrough: stored XSS for admin password change, SSRF to internal Docker container, PHP webshell upload, and … 4 min
  13. 13 Padelify: blind XSS cookie theft to LFI admin takeover TryHackMe Padelify walkthrough: blind XSS with base64 WAF bypass to steal moderator cookie, URL-encoded LFI to read admin … 4 min
  14. 14 Farewell: WAF rate-limit bypass to XSS cookie theft TryHackMe Farewell walkthrough: bypass WAF rate-limiting with X-Forwarded-For to brute-force credentials, stored XSS with string … 4 min
  15. 15 WAF Introduction: from packet filters to OWASP CRS rules TryHackMe WAF Introduction walkthrough: firewall evolution from stateless to Layer 7, WAF fingerprinting, OWASP CRS rule analysis, … 6 min
  16. 16 WAF Exploitation Techniques: encoding and evasion TryHackMe WAF Exploitation Techniques walkthrough: XSS via CRS 3.3.5 bypass, SSTI hex encoding, SQLi comment whitespace, … 4 min
  17. 17 LLM Output Handling: XSS and RCE via model output TryHackMe LLM Output Handling walkthrough covering OWASP LLM05, LLM02, XSS via innerHTML, and command execution through … 6 min
  18. 18 Model Poisoning: supply chain and training data attacks TryHackMe Data Integrity and Model Poisoning walkthrough covering OWASP LLM03 supply chain attacks, model poisoning via training … 5 min
  19. 19 Juicy: XSS to SSRF via unsanitised LLM output TryHackMe Juicy walkthrough covering prompt injection, system prompt leakage, and XSS through unsanitised LLM output to pivot into … 5 min