GIAC labs
Every hands-on lab mapped to a GIAC certification.
Vendor: GIAC clear · browse all certifications
88 labs
Beginner
Evidence Intake & Hash Verification
Receive a USB drive image for a live case, identify it by its contents, verify it against the field examiner's hashes, catch a tampered working copy, and take in new evidence with an unbroken chain of custody.
Beginner
AI Platform Patch Triage & Remediation: CVE-2025-3248
Triage a Critical, CISA-KEV-listed Langflow unauthenticated code-injection RCE (CVE-2025-3248) on /api/v1/validate/code: confirm the version, score it with CVSS, identify CWE-306, judge the pre-auth exposure, upgrade and verify, and recognize that the endpoint should require auth.
Beginner
Analytics Server Patch Triage & Remediation: CVE-2023-38646
Triage a Critical, CISA-KEV-listed Metabase unauthenticated H2 JDBC RCE (CVE-2023-38646): confirm the version, score it with CVSS, identify CWE-94, judge the pre-auth exposure, upgrade and verify.
Beginner
Appliance Patch Triage & Remediation: CVE-2026-10520
Triage a maximum-severity, CISA-KEV-listed Ivanti Sentry unauthenticated OS command injection (CVE-2026-10520) that gives root RCE: confirm the build, score it with CVSS, identify CWE-78, judge the pre-auth appliance exposure, upgrade and verify, and recognize that the management interface should be restricted.
Beginner
Application Server Patch Triage & Remediation: CVE-2025-24813
Triage a maximum-severity, CISA-KEV-listed Apache Tomcat partial-PUT path-equivalence finding (CVE-2025-24813) that can reach RCE: confirm the version and the enabling config, score it with CVSS, identify CWE-44 + CWE-502, judge exposure, upgrade and verify, and recognize the hardening that breaks the chain.
Beginner
Application Server Patch Triage & Remediation: CVE-2026-48282
Triage a maximum-severity, CISA-KEV-listed Adobe ColdFusion path-traversal-to-RCE finding (CVE-2026-48282): confirm the version, score it with CVSS, identify CWE-22, judge the pre-auth exposure, apply the APSB26-68 update and verify, and recognize the lockdown hardening.
Beginner
Automation Platform Patch Triage & Remediation: CVE-2025-68613
Triage a Critical, CISA-KEV-listed n8n workflow-expression RCE (CVE-2025-68613) where a low-trust editor escapes the expression sandbox to run code on the server: confirm the version, score it with CVSS and see why it is 9.9 despite needing a login (scope changed), identify CWE-913, judge the insider threat model, upgrade and verify.
Beginner
BI Platform Patch Triage & Remediation: CVE-2026-72898
Triage a maximum-severity, CISA-KEV-listed Metabase unauthenticated SQL injection (CVE-2026-72898) on /reset_password that yields admin: confirm the version, score it with CVSS, identify CWE-89, judge the pre-auth exposure, upgrade and verify, and recognize that exploited instances need credential rotation.
Beginner
CI/CD Patch Triage & Remediation: CVE-2024-23897
Triage a Critical, CISA-KEV-listed Jenkins CLI arbitrary-file-read finding (CVE-2024-23897): confirm the version, score it with CVSS and see why a file read is 9.8 (unauthenticated, reads controller secrets), identify CWE-27, judge the pre-auth exposure, upgrade and verify, and rotate exposed secrets.
Beginner
DBA Tool Patch Triage & Remediation: CVE-2024-2044
Triage a Critical pgAdmin 4 session path-traversal-to-pickle-RCE finding (CVE-2024-2044): confirm the version, score it with CVSS, identify CWE-31, judge the authenticated low-trust exposure, upgrade and verify, and recognize that exploited instances need credential rotation.
Beginner
Device Patch Triage & Remediation: CVE-2026-2329
Triage a Critical unauthenticated-RCE finding (CVE-2026-2329) across a fleet of Grandstream GXP16xx IP phones: confirm the firmware, score it with CVSS, judge network exposure, push the fixed firmware and verify the fleet is clean.
Beginner
Firewall Patch Triage & Remediation: CVE-2024-3400
Triage a maximum-severity, CISA-KEV-listed PAN-OS GlobalProtect unauthenticated command injection (CVE-2024-3400) that gives root RCE on the perimeter firewall: confirm the version and GlobalProtect config, score it with CVSS, identify CWE-77, judge the pre-auth exposure, upgrade and verify, and assume breach given active exploitation.
Beginner
Framework Patch Triage & Remediation: CVE-2025-29927
Triage a Critical Next.js middleware authorization bypass (CVE-2025-29927): confirm the version, score it with CVSS and see why it is 9.1 despite A:N, identify CWE-285, judge the unauthenticated exposure, upgrade and verify, and know the edge workaround (strip the x-middleware-subrequest header).
Beginner
Framework Patch Triage & Remediation: CVE-2025-55182
Triage a maximum-severity, CISA-KEV-listed React Server Components deserialization RCE (CVE-2025-55182): confirm the package version, score it with CVSS and see why it is 10.0, identify CWE-502, judge the pre-auth exposure, upgrade and verify.
Beginner
Geospatial Server Patch Triage & Remediation: CVE-2024-36401
Triage a Critical, CISA-KEV-listed GeoServer unauthenticated OGC expression RCE (CVE-2024-36401): confirm the version, score it with CVSS, identify CWE-94, judge the pre-auth exposure, upgrade and verify.
Beginner
Graph Database Patch Triage & Remediation: CVE-2024-27348
Triage a Critical, CISA-KEV-listed Apache HugeGraph-Server unauthenticated Gremlin RCE (CVE-2024-27348): confirm the version, score it with CVSS, identify CWE-77, judge the pre-auth exposure, upgrade and verify.
Beginner
Healthcare Integration Engine Patch Triage & Remediation: CVE-2023-43208
Triage a Critical, CISA-KEV-listed NextGen Healthcare Mirth Connect unauthenticated deserialization RCE (CVE-2023-43208): confirm the version, score it with CVSS, identify CWE-502, judge the pre-auth exposure, upgrade and verify.
Beginner
Kernel Patch Triage & Remediation: CVE-2026-31431
Triage a High-severity Linux kernel local-privilege-escalation finding (CVE-2026-31431) on a shared multi-user host: confirm the running kernel, score it with CVSS, judge local exposure, install the branch's fixed release, reboot, and verify the host is clean.
Beginner
Kernel Patch Triage & Remediation: CVE-2026-43284 & CVE-2026-43500
Triage two Linux kernel local-privilege-escalation findings (CVE-2026-43284 and CVE-2026-43500) in one running kernel on a shared host: confirm the kernel, score both with CVSS, judge exposure, then apply the single update that fixes both and verify.
Beginner
LMS Patch Triage & Remediation: CVE-2023-34960
Triage a Critical Chamilo LMS unauthenticated OS command injection (CVE-2023-34960): confirm the version, score it with CVSS, identify CWE-78, judge the pre-auth exposure, upgrade and verify.
Beginner
Print Management Server Patch Triage & Remediation: CVE-2023-27350
Triage a Critical, CISA-KEV-listed PaperCut NG/MF unauthenticated admin bypass to RCE (CVE-2023-27350): confirm the version, score it with CVSS, identify CWE-284, judge the pre-auth exposure, upgrade and verify.
Beginner
Privilege Escalation Patch Triage & Remediation: CVE-2025-32463
Triage a Critical, CISA-KEV-listed sudo --chroot local privilege escalation (CVE-2025-32463) that gives any local user root: confirm the version, score it with CVSS and see why a local bug still scores 9.3 (scope-changed full root), identify CWE-829, judge the shared-host exposure, upgrade and verify.
Beginner
Server Patch Triage & Remediation: CVE-2026-42167
Triage a High-severity ProFTPD SQL-injection finding (CVE-2026-42167) on an internet-facing FTP server: confirm the version, score it with CVSS, understand the conditions it needs, upgrade to the fixed release and verify.
Beginner
Vulnerability Triage & Remediation: CVE-2026-29058
Work a real Critical finding end to end as a Tier-1 analyst: confirm WWBN AVideo CVE-2026-29058 on the host, score it with CVSS, hunt the logs for probe attempts, apply a compensating control, patch to the fixed version, and verify the host is clean.
Beginner
Web App Authentication: Find, Confirm & Fix (Basic)
Hands-on with Authentication Weakness (brute force) (CWE-307) in Acme Accounts's login feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App Broken Access Control: Find, Confirm & Fix (Basic)
Hands-on with Broken Access Control (IDOR) (CWE-639) in Acme Billing's invoice viewer (/invoice?id=). Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App Command Injection: Find, Confirm & Fix (Basic)
Hands-on with Command Injection (CWE-78) in Acme Ops Console's host-diagnostics (ping) feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App CSRF: Find, Confirm & Fix (Basic)
Hands-on with Cross-Site Request Forgery (CSRF) (CWE-352) in Acme Bank's change-password / money-transfer actions. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App File Inclusion: Find, Confirm & Fix (Basic)
Hands-on with File Inclusion (LFI/RFI) (CWE-98) in Acme CMS's page renderer (?page=). Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App File Upload: Find, Confirm & Fix (Basic)
Hands-on with Unrestricted File Upload (CWE-434) in Acme Portal's avatar/document upload feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App SQL Injection: Find, Confirm & Fix (Basic)
Hands-on with SQL Injection (CWE-89) in Acme Store's login / product-search feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App SSRF: Find, Confirm & Fix (Basic)
Hands-on with Server-Side Request Forgery (CWE-918) in a web app's URL-fetch feature. Safely reproduce it with an inert training tool (reach an internal service and the cloud metadata endpoint), classify it as SSRF, score it with CVSS, then fix it with a host allowlist that blocks link-local/metadata and disables redirects, and verify.
Beginner
Web App SSTI: Find, Confirm & Fix (Basic)
Hands-on with Server-Side Template Injection (SSTI) (CWE-1336) in Acme Mailer's greeting/personalization feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App XSS: Find, Confirm & Fix (Basic)
Hands-on with Cross-Site Scripting (XSS) (CWE-79) in Acme Community's comment feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App XXE: Find, Confirm & Fix (Basic)
Hands-on with XML External Entity (XXE) (CWE-611) in Acme Invoicing's XML import feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web Application Patch Triage & Remediation: CVE-2025-31131
Triage a High-severity YesWiki path-traversal file-read finding (CVE-2025-31131): confirm the version, score it with CVSS and see why a read-only bug is still High (unauthenticated, scope-changed), identify CWE-22, judge exposure, upgrade and verify, and recognize that exposed secrets must be rotated.
Beginner
Web Server Patch Triage & Remediation: CVE-2026-42945
Triage a High-severity NGINX heap-overflow finding (CVE-2026-42945) on an internet-facing reverse proxy: confirm the version, score it with CVSS and see why AC:H keeps it below Critical, judge exposure, upgrade to the fixed release and verify.
Beginner
Webmail Patch Triage & Remediation: CVE-2025-49113
Triage a Critical, CISA-KEV-listed Roundcube Webmail PHP object-injection RCE (CVE-2025-49113) reachable by any mailbox user: confirm the version, score it with CVSS, identify CWE-502, judge the low-trust authenticated exposure, upgrade and verify.
Beginner
WordPress Plugin Patch Triage & Remediation: CVE-2026-1357
Triage a Critical WPvivid Backup & Migration arbitrary-file-upload finding (CVE-2026-1357) on an internet-facing WordPress site: confirm the plugin version, score it with CVSS and see why it is Critical, identify CWE-434, judge exposure, update to the fixed release and verify.
Intermediate
Authentication Attack Detection & Incident Response
Respond to a Authentication Weakness (brute force) compromise (CWE-307) in Acme Accounts. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Broken Access Control (IDOR) Detection & Incident Response
Respond to a Broken Access Control (IDOR) compromise (CWE-639) in Acme Billing. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Command Injection Detection & Incident Response
Respond to a Command Injection compromise (CWE-78) in Acme Ops Console. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Cross-Site Request Forgery Detection & Incident Response
Respond to a Cross-Site Request Forgery (CSRF) compromise (CWE-352) in Acme Bank. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Cross-Site Scripting Detection & Incident Response
Respond to a Cross-Site Scripting (XSS) compromise (CWE-79) in Acme Community. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2023-27350
Respond to a PaperCut unauthenticated admin bypass to RCE compromise (CVE-2023-27350). Reconstruct the timeline from the access and service logs, see how an unauthenticated request reached the admin console and ran a device script as SYSTEM, find the rogue local account, engineer a detection rule for unauthenticated access to the SetupCompleted admin page, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2023-34960
Respond to a Chamilo unauthenticated OS command injection compromise (CVE-2023-34960). Reconstruct the timeline from the access and service logs, see how a crafted file name in a SOAP call was passed to a shell, find the PHP web shell, engineer a detection rule for wsConvertPpt calls with shell metacharacters in file_name, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2023-38646
Respond to a Metabase unauthenticated H2 JDBC RCE compromise (CVE-2023-38646). Reconstruct the timeline from the access and service logs, see how an H2 JDBC connection string executed code at connect time, pre-auth, find the scheduled-task persistence, engineer a detection rule for database-validation requests using the H2 engine with an INIT clause, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2023-43208
Respond to a Mirth Connect unauthenticated deserialization RCE compromise (CVE-2023-43208). Reconstruct the timeline from the access and service logs, see how an unauthenticated XML body was deserialized into a gadget chain and ran code, find the rogue channel, engineer a detection rule for unauthenticated API bodies containing deserialization gadget markers, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2024-2044
Respond to a pgAdmin 4 session-traversal pickle-RCE compromise (CVE-2024-2044). Reconstruct the timeline from the access and service logs, see how traversal in the session id loaded an attacker pickle and ran code, find the staged-pickle persistence, engineer a detection rule for traversal, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2024-23897
Respond to a Jenkins CLI arbitrary-file-read breach (CVE-2024-23897). Reconstruct the timeline from the access and read logs, see how @<path> arguments inlined master.key and credentials.xml, scope the exposure, engineer a detection rule for the @-file pattern, then contain by disabling the CLI feature, eradicate (upgrade + rotate secrets), verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2024-27348
Respond to a HugeGraph unauthenticated Gremlin RCE compromise (CVE-2024-27348). Reconstruct the timeline from the access and service logs, see how a Gremlin query bypassed the sandbox via reflection and ran OS commands, find the rogue cron entry, engineer a detection rule for Gremlin scripts that use reflection to reach Runtime/ProcessBuilder, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2024-3400
Respond to a PAN-OS GlobalProtect command-injection compromise (CVE-2024-3400). Reconstruct the timeline from the access and service logs, see how shell metacharacters in the SESSID value ran commands as root, find the web-implant persistence, engineer a detection rule for the malicious SESSID pattern, then contain, eradicate, upgrade, verify and report - assuming breach.
Intermediate
Detection Engineering & Incident Response: CVE-2024-36401
Respond to a GeoServer unauthenticated OGC expression RCE compromise (CVE-2024-36401). Reconstruct the timeline from the access and service logs, see how a request property name was evaluated as an expression and ran code, find the JSP web implant, engineer a detection rule for OGC requests whose property reference is an expression (exec()/Runtime), then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-24813
Respond to a Apache Tomcat partial-PUT path-equivalence compromise (CVE-2025-24813). Reconstruct the timeline from the access and work-dir logs, see how the `..;/` trick wrote a session file that FileStore deserialized into RCE, find the staged-session persistence, engineer a detection rule for the malicious PUT pattern, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-29927
Respond to a Next.js middleware-auth-bypass compromise (CVE-2025-29927). Reconstruct the timeline from the access and session logs, see how the x-middleware-subrequest header made middleware skip and exposed /admin, find the backdoor-admin persistence, engineer a detection rule for the bypass header, then contain at the edge, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-31131
Respond to a YesWiki path-traversal data breach (CVE-2025-31131). Reconstruct the timeline from the access and file-read logs, see how squelette traversal read /etc/passwd and the config (DB credentials), scope the exposure, engineer a detection rule for traversal, then contain at the WAF, eradicate (upgrade + rotate the exposed secrets), verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-32463
Respond to a sudo --chroot local-privilege-escalation compromise (CVE-2025-32463). Reconstruct the timeline from the sudo auth and activity logs, see how --chroot loaded an attacker nsswitch.conf as root, find the SUID-root backdoor persistence, engineer a detection rule for the chroot option, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-3248
Respond to a Langflow unauthenticated code-injection compromise (CVE-2025-3248). Reconstruct the timeline from the access and service logs, see how /api/v1/validate/code executed posted code with no auth, find the rogue-cron persistence, engineer a detection rule for the code endpoint, then contain, eradicate, upgrade, verify and report - including rotating keys.
Intermediate
Detection Engineering & Incident Response: CVE-2025-49113
Respond to a Roundcube Webmail object-injection compromise (CVE-2025-49113). Reconstruct the timeline from the access and PHP logs, see how a serialized _from value was unserialized into a gadget and ran code, find the web-shell persistence, engineer a detection rule for the serialization markers, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-55182
Respond to a React Server Components deserialization-RCE compromise (CVE-2025-55182). Reconstruct the timeline from the access and execution logs, see how a server-action payload resolved an arbitrary reference and ran as the node process, find the dropped-script persistence, engineer a detection rule for the malicious payload marker, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-68613
Respond to an n8n workflow-expression RCE compromise (CVE-2025-68613). Reconstruct the timeline from the n8n audit and execution logs, see how an expression calling require()/child_process escaped the sandbox and ran as the n8n process, find the attacker's rogue scheduled-workflow persistence, engineer a detection rule for dangerous expressions, then contain by restricting editing, eradicate, upgrade, verify and report - including rotating stored credentials.
Intermediate
Detection Engineering & Incident Response: CVE-2026-10520
Respond to a Ivanti Sentry OS-command-injection compromise (CVE-2026-10520). Reconstruct the timeline from the access and service logs, see how shell metacharacters in a host parameter ran commands as root, find the rogue root-cron persistence, engineer a detection rule for the injection pattern, then contain by restricting the interface, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-1357
Respond to a WPvivid file-upload compromise (CVE-2026-1357). Reconstruct the timeline from the web access log and the plugin upload log, see how filename traversal placed PHP in a web-accessible directory, find the attacker's rogue must-use-plugin persistence, engineer a detection rule for the malicious upload pattern, then contain, eradicate, update, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-2329
Respond to an unauthenticated-RCE compromise of a Grandstream IP phone (CVE-2026-2329). Reconstruct the timeline from web and device logs, find the attacker's rogue provisioning persistence, engineer and tune a detection rule for the overflow pattern, then contain, eradicate (firmware + config), verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-29058
Respond to a live compromise of a WWBN AVideo host (CVE-2026-29058). Reconstruct the attack timeline from correlated logs, determine impact and find the attacker's persistence, engineer and tune a behavioral detection rule to zero false negatives and false positives, then contain, eradicate, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-31431
Respond to a local privilege-escalation compromise on a shared Linux host (CVE-2026-31431). Reconstruct the timeline from auth and audit logs, find the attacker's sudoers persistence, engineer and tune a behavioral detection rule, then contain, eradicate, patch, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-42167
Respond to a ProFTPD SQL-injection compromise (CVE-2026-42167). Reconstruct the timeline from the FTP auth log and SQL backend log, see how COPY TO PROGRAM turned injection into RCE, find the attacker's cron persistence, engineer a detection rule for malicious usernames, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-42945
Respond to an NGINX worker-crash incident (CVE-2026-42945). Reconstruct the timeline from access and error logs, assess DoS versus RCE using the host ASLR setting, find the vulnerable rewrite config, engineer a detection rule, then contain with a config change, eradicate with an upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-43284 & CVE-2026-43500
Respond to a local privilege-escalation compromise on a host exposed to two related kernel bugs (CVE-2026-43284 and CVE-2026-43500). Reconstruct the timeline, find the attacker's persistence, engineer one detection rule covering both vulnerable subsystems, then contain, eradicate, patch both with one update, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-48282
Respond to a Adobe ColdFusion path-traversal-to-RCE compromise (CVE-2026-48282). Reconstruct the timeline from the access and server logs, see how traversal in a template parameter included an attacker .cfm and ran code, find the CFM web-shell persistence, engineer a detection rule for traversal, then contain, eradicate, update, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-72898
Respond to a Metabase SQL-injection compromise (CVE-2026-72898). Reconstruct the timeline from the access and database logs, see how /reset_password injection yielded admin, find the backdoor-superuser persistence, engineer a detection rule for the injection pattern, then contain at the WAF, eradicate, upgrade, verify and report - including rotating connected-DB credentials.
Intermediate
File Inclusion Detection & Incident Response
Respond to a File Inclusion (LFI/RFI) compromise (CWE-98) in Acme CMS. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Server-Side Template Injection Detection & Incident Response
Respond to a Server-Side Template Injection (SSTI) compromise (CWE-1336) in Acme Mailer. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
SQL Injection Detection & Incident Response
Respond to a SQL Injection compromise (CWE-89) in Acme Store. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
SSRF Detection & Incident Response
Respond to a Server-Side Request Forgery compromise (CWE-918) where a web app's URL-fetch feature was aimed at the cloud metadata endpoint and leaked IAM credentials. Reconstruct the timeline from the access and fetch logs, scope the credential exposure, engineer a detection rule for fetches aimed at internal/link-local targets (tuned past a benign look-alike), then contain with an allowlist, rotate the exposed credentials, verify and report.
Intermediate
Unrestricted File Upload Detection & Incident Response
Respond to a Unrestricted File Upload compromise (CWE-434) in Acme Portal. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
XML External Entity Detection & Incident Response
Respond to a XML External Entity (XXE) compromise (CWE-611) in Acme Invoicing. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Expert
Root-Cause & Secure-Code Remediation: Authentication
Fix Authentication Weakness (brute force) (CWE-307) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: Broken Access Control
Fix Broken Access Control (IDOR) (CWE-639) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: Command Injection
Fix Command Injection (CWE-78) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CSRF
Fix Cross-Site Request Forgery (CSRF) (CWE-352) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: File Inclusion
Fix File Inclusion (LFI/RFI) (CWE-98) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: File Upload
Fix Unrestricted File Upload (CWE-434) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: SQL Injection
Fix SQL Injection (CWE-89) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: SSRF
Fix Server-Side Request Forgery (CWE-918) at the source. Read the vulnerable URL-fetch handler, see how it fetches any user URL and follows redirects, reject a substring blocklist, and apply the real fix: allowlist the host, resolve it and reject loopback/link-local/private IPs, and disable redirects. Record IMDSv2 + egress hardening and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: SSTI
Fix Server-Side Template Injection (SSTI) (CWE-1336) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: XSS
Fix Cross-Site Scripting (XSS) (CWE-79) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: XXE
Fix XML External Entity (XXE) (CWE-611) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.