Roadmap

Exploit a real SSRF attack in a link-preview SaaS to reach the cloud metadata service (IMDS), steal the instance's temporary IAM credentials, and abuse an over-permissive role to read an internal secret. Run the full SSRF-to-cloud chain hands-on in the Attack Terminal.

Base64 and hex look scrambled, so people treat them like encryption. They are not: anyone reverses them in seconds. You'll learn to spot and peel encoding layers by hand and with CyberChef, the move every crypto challenge opens with. 🧩

Adding a guardrail and calling it safe is the mistake that ships breaches. You will wrap a leaky AI bot in real defenses, watch the leak rate fall from 7-in-10 to nearly zero, and learn the layer attackers cannot argue with. 🛡️

Model output is just untrusted input wearing a disguise. You'll make a model spit out an XSS payload, watch a Flask app run it, and disarm it with one line: the same encode-at-the-sink fix triagers love to see. 🔒

An agent is a model plus tools plus a loop. You'll build one, then a planted note will make it fetch an internal address and leak credentials: SSRF, RCE, and data loss, all reached through the tools you handed it. 🛠️

Learn how to jailbreak an AI by prompt-injecting a real language model to leak its hidden system prompt and abuse its internal tool. A hands-on OWASP LLM01 and LLM06 lab you solve from the Attack Terminal with curl.

A scrambled-alphabet cipher has 26! keys, so people call it unbreakable. It is not: E stays the most common letter whatever costume it wears. You'll brute-force Caesar and crack a monoalphabetic cipher with frequency analysis. 🔍

A repeating key hides the letter E behind many faces, so frequency analysis stalls. But repeats in the ciphertext leak the key length. You'll run the Kasiski examination, recover the key, and decrypt the indecipherable cipher in minutes. 🗝️

The one-time pad is unbreakable, until the key repeats. Then 256 guesses or xortool peel it open. Learn single-byte brute force, key-length by Hamming distance, and crib dragging, the exact moves of malware triage. 🧩

A hash is not encryption and you never decrypt it. You will watch the avalanche effect, tell a collision from a preimage, identify a hash with hashid, and forge a signature with length extension. HMAC is the fix. 🧩

AES the algorithm can be unbreakable while the mode leaks everything. In 2013 around 150 million Adobe passwords fell to ECB plus plaintext hints. Learn to spot repeating blocks, bit-flip CBC, and pick the mode that holds. 🔑

RSA is not magic: pick two primes, multiply, publish the product. Its only secret is that nobody can un-multiply a big number. Build a working keypair in six lines of Python and read a real key with openssl, before you attack one. 🧮

RSA almost never falls to brute force. It falls to bad keys: close primes, a tiny exponent, reused randomness. You will factor with factordb and Fermat, recover d, decrypt by hand, and run RsaCtfTool across the whole attack set. 🧩

Two strangers can agree on a secret key in full public view, and a strong algorithm still falls if the random numbers under it are predictable. You'll run Diffie-Hellman by hand, break a small one, and make Python's random module repeat itself. 🔑