Deserialized Dreams

ما ستتعلّمه

Server-Side Request Forgery (SSRF) and bypassing a naive host blocklist to reach loopback-only services (OWASP A10).
Discovering and fingerprinting an internal, unpublished HTTP service through an SSRF oracle.
Insecure deserialization of Python `pickle` and writing a `__reduce__` RCE gadget by hand (OWASP A08).
Chaining an access flaw into code execution and exfiltrating output through the only channel you have.

سجّل الدخول لقراءة المهام وتشغيل الجهاز والإجابة عن الأسئلة.