{"version":1,"generatedAt":"2026-08-14T17:26:35.419Z","site":"https://koadt.github.io/oss-oopssec-store/","roadmapUrl":"https://koadt.github.io/oss-oopssec-store/roadmap","totalChallenges":36,"challengesByDifficulty":{"EASY":6,"MEDIUM":19,"HARD":11},"challenges":[{"number":1,"title":"Public env variable leak","slug":"public-env-variable","difficulty":"EASY","category":"INFORMATION_DISCLOSURE","estimatedMinutes":{"min":15,"max":20},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-01","chapter":{"index":1,"title":"Reconnaissance & Disclosure","tagline":"Most attacks start with reading, not exploiting.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-01"},"prerequisites":[],"walkthrough":{"slug":"next-public-env-variable-leak","title":"Reading Secrets From the Browser: The NEXT_PUBLIC_ Trap in Next.js","description":"Exploiting a misused NEXT_PUBLIC_ environment variable in OopsSec Store to recover a payment secret embedded in the client JavaScript bundle.","url":"https://koadt.github.io/oss-oopssec-store/posts/next-public-env-variable-leak"}},{"number":2,"title":"Information disclosure via API errors","slug":"information-disclosure-api-error","difficulty":"EASY","category":"INFORMATION_DISCLOSURE","estimatedMinutes":{"min":15,"max":20},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-02","chapter":{"index":1,"title":"Reconnaissance & Disclosure","tagline":"Most attacks start with reading, not exploiting.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-01"},"prerequisites":[],"walkthrough":{"slug":"information-disclosure-api-error","title":"Leaking Secrets Through Error Messages: Exploiting a Verbose API Debug Response","description":"A data export endpoint dumps system diagnostics when it hits an invalid field. Feed it garbage, read the debug output, grab the flag.","url":"https://koadt.github.io/oss-oopssec-store/posts/information-disclosure-api-error"}},{"number":3,"title":"Plaintext passwords in logs","slug":"plaintext-password-in-logs","difficulty":"MEDIUM","category":"INFORMATION_DISCLOSURE","estimatedMinutes":{"min":30,"max":30},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-03","chapter":{"index":1,"title":"Reconnaissance & Disclosure","tagline":"Most attacks start with reading, not exploiting.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-01"},"prerequisites":[],"walkthrough":{"slug":"plaintext-password-in-logs","title":"Plaintext Password Exposure: Exploiting Server Logs via a Hidden SIEM Interface","description":"Exploiting a forgotten debug statement that logs plaintext passwords and a hidden SIEM dashboard with hardcoded credentials to retrieve a flag.","url":"https://koadt.github.io/oss-oopssec-store/posts/plaintext-password-in-logs"}},{"number":4,"title":"Insecure Direct Object Reference (IDOR)","slug":"insecure-direct-object-reference","difficulty":"EASY","category":"AUTHORIZATION","estimatedMinutes":{"min":20,"max":30},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-04","chapter":{"index":2,"title":"Broken Access Control","tagline":"The bug almost every API has somewhere.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-02"},"prerequisites":[],"walkthrough":{"slug":"idor-order-privacy-breach","title":"Insecure Direct Object Reference: Unauthorized Order Access","description":"How changing one number in the URL lets you read anyone's order on OopsSec Store.","url":"https://koadt.github.io/oss-oopssec-store/posts/idor-order-privacy-breach"}},{"number":5,"title":"Open redirect to login bypass","slug":"open-redirect","difficulty":"EASY","category":"INPUT_VALIDATION","estimatedMinutes":{"min":20,"max":30},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-05","chapter":{"index":2,"title":"Broken Access Control","tagline":"The bug almost every API has somewhere.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-02"},"prerequisites":[],"walkthrough":{"slug":"open-redirect-login-bypass","title":"Open Redirect: Accessing Internal Pages via Login Redirect","description":"Exploit an unvalidated redirect parameter on OopsSec Store's login page to reach a restricted internal OAuth callback endpoint.","url":"https://koadt.github.io/oss-oopssec-store/posts/open-redirect-login-bypass"}},{"number":6,"title":"Broken Object Level Authorization (BOLA)","slug":"broken-object-level-authorization","difficulty":"MEDIUM","category":"AUTHORIZATION","estimatedMinutes":{"min":45,"max":60},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-06","chapter":{"index":2,"title":"Broken Access Control","tagline":"The bug almost every API has somewhere.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-02"},"prerequisites":[],"walkthrough":{"slug":"bola-wishlist-access","title":"Broken Object Level Authorization: Accessing Private Wishlists","description":"A BOLA vulnerability in OopsSec Store's wishlist API lets any logged-in user read anyone else's private wishlist, including an admin one that contains the flag.","url":"https://koadt.github.io/oss-oopssec-store/posts/bola-wishlist-access"}},{"number":7,"title":"Broken Function Level Authorization (live stream hijack)","slug":"broken-function-level-authorization","difficulty":"MEDIUM","category":"AUTHORIZATION","estimatedMinutes":{"min":45,"max":60},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-07","chapter":{"index":2,"title":"Broken Access Control","tagline":"The bug almost every API has somewhere.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-02"},"prerequisites":[],"walkthrough":{"slug":"live-stream-hijack","title":"Broken Function Level Authorization: Hijacking the Live Stream","description":"OopsSec Live hides the broadcast controls from non-admins in the UI, but the API never checks your role. Any logged-in customer can replace the live stream, exactly like the 2026 FIFA internal-systems hack.","url":"https://koadt.github.io/oss-oopssec-store/posts/live-stream-hijack"}},{"number":8,"title":"Path traversal in document API","slug":"path-traversal","difficulty":"MEDIUM","category":"INPUT_VALIDATION","estimatedMinutes":{"min":30,"max":45},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-08","chapter":{"index":2,"title":"Broken Access Control","tagline":"The bug almost every API has somewhere.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-02"},"prerequisites":[],"walkthrough":{"slug":"path-traversal-documents-api","title":"Path Traversal: Escaping the Documents Directory via the Files API","description":"Exploiting an unsanitized file path parameter in OopsSec Store's documents API to read files outside the intended directory and retrieve a flag.","url":"https://koadt.github.io/oss-oopssec-store/posts/path-traversal-documents-api"}},{"number":9,"title":"Client-side price manipulation","slug":"client-side-price-manipulation","difficulty":"MEDIUM","category":"INPUT_VALIDATION","estimatedMinutes":{"min":30,"max":45},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-09","chapter":{"index":3,"title":"Trusting the Client","tagline":"Whatever the browser sends, the server has to verify.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-03"},"prerequisites":[],"walkthrough":{"slug":"client-side-price-manipulation","title":"Client-Side Price Manipulation","description":"Exploiting a server-side validation failure in OopsSec Store's checkout process to purchase products at arbitrary prices.","url":"https://koadt.github.io/oss-oopssec-store/posts/client-side-price-manipulation"}},{"number":10,"title":"Mass assignment to admin role","slug":"mass-assignment","difficulty":"MEDIUM","category":"INPUT_VALIDATION","estimatedMinutes":{"min":45,"max":60},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-10","chapter":{"index":3,"title":"Trusting the Client","tagline":"Whatever the browser sends, the server has to verify.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-03"},"prerequisites":[],"walkthrough":{"slug":"mass-assignment-admin-privilege-escalation","title":"Mass Assignment: Admin Privilege Escalation via Signup","description":"Exploiting a mass assignment vulnerability in OopsSec Store's signup endpoint to create an account with administrator privileges.","url":"https://koadt.github.io/oss-oopssec-store/posts/mass-assignment-admin-privilege-escalation"}},{"number":11,"title":"Middleware bypass (CVE-2025-29927)","slug":"middleware-authorization-bypass","difficulty":"MEDIUM","category":"AUTHORIZATION","estimatedMinutes":{"min":30,"max":45},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-11","chapter":{"index":3,"title":"Trusting the Client","tagline":"Whatever the browser sends, the server has to verify.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-03"},"prerequisites":[],"walkthrough":{"slug":"middleware-authorization-bypass-cve-2025-29927","title":"Middleware Authorization Bypass: Skipping Next.js Auth with a Single Header (CVE-2025-29927)","description":"Exploiting CVE-2025-29927 to bypass Next.js middleware-based authentication using the x-middleware-subrequest internal header, accessing a protected internal status page without credentials.","url":"https://koadt.github.io/oss-oopssec-store/posts/middleware-authorization-bypass-cve-2025-29927"}},{"number":12,"title":"Race condition coupon abuse","slug":"race-condition-coupon-abuse","difficulty":"HARD","category":"INSECURE_DESIGN","estimatedMinutes":{"min":45,"max":90},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-12","chapter":{"index":3,"title":"Trusting the Client","tagline":"Whatever the browser sends, the server has to verify.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-03"},"prerequisites":[],"walkthrough":{"slug":"race-condition-coupon-abuse","title":"Race Condition: abusing a single-use coupon with concurrent requests","description":"OopsSec Store validates a coupon and increments its counter in two separate database calls. Send enough concurrent requests and several slip through the check before any of them completes the increment.","url":"https://koadt.github.io/oss-oopssec-store/posts/race-condition-coupon-abuse"}},{"number":13,"title":"Stored XSS in product reviews","slug":"cross-site-scripting-xss","difficulty":"EASY","category":"INJECTION","estimatedMinutes":{"min":30,"max":45},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-13","chapter":{"index":4,"title":"Cross-Site Attacks","tagline":"Your input, running in someone else's browser.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-04"},"prerequisites":[],"walkthrough":{"slug":"stored-xss-product-reviews","title":"Stored XSS in Product Reviews","description":"Exploiting stored cross-site scripting in OopsSec Store's product review functionality to execute JavaScript in every visitor's browser.","url":"https://koadt.github.io/oss-oopssec-store/posts/stored-xss-product-reviews"}},{"number":14,"title":"Self-XSS in profile bio","slug":"self-xss-profile-injection","difficulty":"EASY","category":"INJECTION","estimatedMinutes":{"min":20,"max":30},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-14","chapter":{"index":4,"title":"Cross-Site Attacks","tagline":"Your input, running in someone else's browser.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-04"},"prerequisites":[],"walkthrough":{"slug":"self-xss-csrf-profile-takeover","title":"Profile Takeover: Chaining Self-XSS with CSRF","description":"A Self-XSS in the profile bio editor is harmless on its own. Chain it with a missing CSRF token on the update endpoint and you get cross-user profile takeover.","url":"https://koadt.github.io/oss-oopssec-store/posts/self-xss-csrf-profile-takeover"}},{"number":15,"title":"CSRF on admin order update","slug":"cross-site-request-forgery","difficulty":"MEDIUM","category":"REQUEST_FORGERY","estimatedMinutes":{"min":45,"max":60},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-15","chapter":{"index":4,"title":"Cross-Site Attacks","tagline":"Your input, running in someone else's browser.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-04"},"prerequisites":[],"walkthrough":{"slug":"csrf-admin-order-update","title":"Cross-Site Request Forgery on the Admin Order Update Endpoint","description":"The admin order update endpoint authenticates via cookie and validates nothing else, allowing any same-session page to flip an order's status on the admin's behalf.","url":"https://koadt.github.io/oss-oopssec-store/posts/csrf-admin-order-update"}},{"number":16,"title":"CSRF + Self-XSS profile takeover","slug":"csrf-profile-takeover-chain","difficulty":"HARD","category":"REQUEST_FORGERY","estimatedMinutes":{"min":90,"max":120},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-16","chapter":{"index":4,"title":"Cross-Site Attacks","tagline":"Your input, running in someone else's browser.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-04"},"prerequisites":[14,15],"walkthrough":{"slug":"self-xss-csrf-profile-takeover","title":"Profile Takeover: Chaining Self-XSS with CSRF","description":"A Self-XSS in the profile bio editor is harmless on its own. Chain it with a missing CSRF token on the update endpoint and you get cross-user profile takeover.","url":"https://koadt.github.io/oss-oopssec-store/posts/self-xss-csrf-profile-takeover"}},{"number":17,"title":"SQL injection in order search","slug":"sql-injection","difficulty":"MEDIUM","category":"INJECTION","estimatedMinutes":{"min":30,"max":45},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-17","chapter":{"index":5,"title":"SQL Injection Deep Dive","tagline":"One quote, one query, one breach.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-05"},"prerequisites":[],"walkthrough":{"slug":"sql-injection-writeup","title":"SQL Injection: From Dropdown to Database Dump","description":"How a simple order status filter can be exploited to extract every user's credentials from the database.","url":"https://koadt.github.io/oss-oopssec-store/posts/sql-injection-writeup"}},{"number":18,"title":"Product search SQLi","slug":"product-search-sql-injection","difficulty":"MEDIUM","category":"INJECTION","estimatedMinutes":{"min":30,"max":45},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-18","chapter":{"index":5,"title":"SQL Injection Deep Dive","tagline":"One quote, one query, one breach.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-05"},"prerequisites":[],"walkthrough":{"slug":"product-search-sql-injection","title":"Exploiting a Product Search SQL Injection","description":"How to exploit a vulnerability in a tiny search box to quietly expose an entire database.","url":"https://koadt.github.io/oss-oopssec-store/posts/product-search-sql-injection"}},{"number":19,"title":"X-Forwarded-For SQLi","slug":"x-forwarded-for-sql-injection","difficulty":"HARD","category":"INJECTION","estimatedMinutes":{"min":60,"max":90},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-19","chapter":{"index":5,"title":"SQL Injection Deep Dive","tagline":"One quote, one query, one breach.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-05"},"prerequisites":[17,18],"walkthrough":{"slug":"x-forwarded-for-sql-injection","title":"SQL Injection via X-Forwarded-For Header: Exploiting IP Tracking","description":"The app tracks visitor IPs via the X-Forwarded-For header and drops the raw value into a SQL query. Here's how to exploit it.","url":"https://koadt.github.io/oss-oopssec-store/posts/x-forwarded-for-sql-injection"}},{"number":20,"title":"Second-order SQL injection","slug":"second-order-sql-injection","difficulty":"HARD","category":"INJECTION","estimatedMinutes":{"min":60,"max":90},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-20","chapter":{"index":5,"title":"SQL Injection Deep Dive","tagline":"One quote, one query, one breach.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-05"},"prerequisites":[17,18],"walkthrough":{"slug":"second-order-sql-injection","title":"Second-Order SQL Injection: When Trusted Data Turns Hostile","description":"How a crafted display name stored through a product review becomes a SQL injection payload when an admin filters reviews on the moderation panel.","url":"https://koadt.github.io/oss-oopssec-store/posts/second-order-sql-injection"}},{"number":21,"title":"Malicious file upload (SVG XSS)","slug":"malicious-file-upload","difficulty":"HARD","category":"INJECTION","estimatedMinutes":{"min":45,"max":60},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-21","chapter":{"index":6,"title":"Parsers Behaving Badly","tagline":"Parsers go where your business logic can't.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-06"},"prerequisites":[],"walkthrough":{"slug":"malicious-file-upload-stored-xss","title":"Malicious File Upload: Stored XSS via SVG","description":"Upload a malicious SVG to the admin product image field and get stored XSS that fires for every visitor.","url":"https://koadt.github.io/oss-oopssec-store/posts/malicious-file-upload-stored-xss"}},{"number":22,"title":"XXE in supplier order import","slug":"xxe-supplier-order-import","difficulty":"HARD","category":"INJECTION","estimatedMinutes":{"min":45,"max":60},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-22","chapter":{"index":6,"title":"Parsers Behaving Badly","tagline":"Parsers go where your business logic can't.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-06"},"prerequisites":[],"walkthrough":{"slug":"xxe-supplier-order-import","title":"XML External Entity Injection: Exploiting a Legacy Supplier Import Endpoint","description":"Exploiting an insecure XML parser in the supplier order import feature to read arbitrary server-side files and retrieve a flag.","url":"https://koadt.github.io/oss-oopssec-store/posts/xxe-supplier-order-import"}},{"number":23,"title":"Weak JWT secret","slug":"weak-jwt-secret","difficulty":"MEDIUM","category":"AUTHENTICATION","estimatedMinutes":{"min":45,"max":60},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-23","chapter":{"index":7,"title":"Authentication Failures","tagline":"Login is a feature. Auth is a system.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-07"},"prerequisites":[],"walkthrough":{"slug":"jwt-weak-secret-admin-bypass","title":"JWT Weak Secret: Cracking the Key to Forge Admin Access in OopsSec Store","description":"Exploiting a JWT implementation that uses a weak signing secret to crack the key, forge admin credentials, and access restricted endpoints.","url":"https://koadt.github.io/oss-oopssec-store/posts/jwt-weak-secret-admin-bypass"}},{"number":24,"title":"Brute force, no rate limiting","slug":"brute-force-no-rate-limiting","difficulty":"MEDIUM","category":"AUTHENTICATION","estimatedMinutes":{"min":30,"max":45},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-24","chapter":{"index":7,"title":"Authentication Failures","tagline":"Login is a feature. Auth is a system.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-07"},"prerequisites":[],"walkthrough":{"slug":"brute-force-no-rate-limiting","title":"Brute Force Attack: Exploiting a Login Endpoint With No Rate Limiting","description":"Brute forcing a user password through an unprotected login endpoint using rockyou.txt.","url":"https://koadt.github.io/oss-oopssec-store/posts/brute-force-no-rate-limiting"}},{"number":25,"title":"Session fixation","slug":"session-fixation-weak-session-management","difficulty":"MEDIUM","category":"AUTHENTICATION","estimatedMinutes":{"min":60,"max":90},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-25","chapter":{"index":7,"title":"Authentication Failures","tagline":"Login is a feature. Auth is a system.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-07"},"prerequisites":[],"walkthrough":{"slug":"session-fixation-weak-session-management","title":"Session Fixation: Hijacking an Admin Account Through Support Access","description":"Exploiting a mass assignment flaw in a support access token endpoint to generate a session for the admin account and access the admin dashboard.","url":"https://koadt.github.io/oss-oopssec-store/posts/session-fixation-weak-session-management"}},{"number":26,"title":"Insecure password reset","slug":"insecure-password-reset","difficulty":"MEDIUM","category":"AUTHENTICATION","estimatedMinutes":{"min":45,"max":60},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-26","chapter":{"index":7,"title":"Authentication Failures","tagline":"Login is a feature. Auth is a system.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-07"},"prerequisites":[],"walkthrough":{"slug":"insecure-password-reset","title":"Insecure Password Reset: Predictable Token Forgery","description":"Exploit a predictable password reset token generation mechanism to take over any user account.","url":"https://koadt.github.io/oss-oopssec-store/posts/insecure-password-reset"}},{"number":27,"title":"SSRF internal page access","slug":"server-side-request-forgery","difficulty":"MEDIUM","category":"REQUEST_FORGERY","estimatedMinutes":{"min":45,"max":60},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-27","chapter":{"index":8,"title":"Server-Side Request Forgery","tagline":"Make the server fetch what you can't.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-08"},"prerequisites":[],"walkthrough":{"slug":"ssrf-internal-page-access","title":"Server-Side Request Forgery: Accessing Internal Pages via Support Form","description":"Exploiting a server-side request forgery vulnerability in OopsSec Store's support form to access restricted internal pages.","url":"https://koadt.github.io/oss-oopssec-store/posts/ssrf-internal-page-access"}},{"number":28,"title":"Weak MD5 password hashing","slug":"weak-md5-hashing","difficulty":"MEDIUM","category":"CRYPTOGRAPHIC","estimatedMinutes":{"min":30,"max":45},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-28","chapter":{"index":9,"title":"Cryptography Done Wrong","tagline":"Modern crypto is safe by default. Until it isn't.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-09"},"prerequisites":[],"walkthrough":{"slug":"weak-md5-hashing-admin-compromise","title":"Chaining SQL Injection and Weak MD5 Hashing to Compromise the Admin Account","description":"Exploiting a database leak combined with weak MD5 password hashing to gain admin access.","url":"https://koadt.github.io/oss-oopssec-store/posts/weak-md5-hashing-admin-compromise"}},{"number":29,"title":"Insecure randomness in gift cards","slug":"insecure-randomness-gift-card","difficulty":"MEDIUM","category":"CRYPTOGRAPHIC","estimatedMinutes":{"min":45,"max":60},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-29","chapter":{"index":9,"title":"Cryptography Done Wrong","tagline":"Modern crypto is safe by default. Until it isn't.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-09"},"prerequisites":[],"walkthrough":{"slug":"insecure-randomness-gift-card","title":"Insecure Randomness: recovering a gift card code from its timestamp","description":"OopsSec Store derives gift card codes from a linear congruential generator seeded with the card's creation timestamp. The timestamp is exposed to the buyer with millisecond precision, which is all you need to reproduce the code and redeem the card from a different account.","url":"https://koadt.github.io/oss-oopssec-store/posts/insecure-randomness-gift-card"}},{"number":30,"title":"AES-CBC padding oracle","slug":"aes-cbc-padding-oracle","difficulty":"HARD","category":"CRYPTOGRAPHIC","estimatedMinutes":{"min":90,"max":120},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-30","chapter":{"index":9,"title":"Cryptography Done Wrong","tagline":"Modern crypto is safe by default. Until it isn't.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-09"},"prerequisites":[],"walkthrough":{"slug":"aes-cbc-padding-oracle-forged-share-token","title":"Padding oracle attack: forging encrypted share tokens","description":"A padding oracle in OopsSec Store's share feature leaks whether decryption produced valid PKCS#7 padding. That's enough to forge a token for an internal report and grab the flag.","url":"https://koadt.github.io/oss-oopssec-store/posts/aes-cbc-padding-oracle-forged-share-token"}},{"number":31,"title":"JWT algorithm confusion (partner API)","slug":"jwt-algorithm-confusion","difficulty":"HARD","category":"CRYPTOGRAPHIC","estimatedMinutes":{"min":90,"max":120},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-31","chapter":{"index":9,"title":"Cryptography Done Wrong","tagline":"Modern crypto is safe by default. Until it isn't.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-09"},"prerequisites":[23],"walkthrough":{"slug":"jwt-algorithm-confusion-partner-api","title":"JWT algorithm confusion: turning a public key into a signing secret","description":"OopsSec Store publishes its partner signing key on purpose, so partners can verify webhooks. Its token verifier also accepts HS256. Those two facts together let anyone mint a token for any supplier and read their purchase orders.","url":"https://koadt.github.io/oss-oopssec-store/posts/jwt-algorithm-confusion-partner-api"}},{"number":32,"title":"Prompt injection in AI assistant","slug":"prompt-injection-ai-assistant","difficulty":"MEDIUM","category":"INJECTION","estimatedMinutes":{"min":60,"max":90},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-32","chapter":{"index":10,"title":"AI & LLM Security","tagline":"The new attack surface nobody trained for.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-10"},"prerequisites":[],"walkthrough":{"slug":"prompt-injection-ai-assistant","title":"Prompt Injection: Extracting Secrets from the AI Assistant","description":"A walkthrough of prompt injection attacks against OopsSec Store's AI assistant, bypassing its input filters to extract a flag from the system prompt.","url":"https://koadt.github.io/oss-oopssec-store/posts/prompt-injection-ai-assistant"}},{"number":33,"title":"MCP malicious server","slug":"mcp-malicious-server","difficulty":"HARD","category":"INJECTION","estimatedMinutes":{"min":90,"max":120},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-33","chapter":{"index":10,"title":"AI & LLM Security","tagline":"The new attack surface nobody trained for.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-10"},"prerequisites":[],"walkthrough":{"slug":"mcp-malicious-server","title":"Malicious MCP Server: Poisoning an AI Agent Through Tool Responses","description":"We host a malicious MCP server whose tool responses trick OSSBot into calling a restricted internal tool and leaking the flag.","url":"https://koadt.github.io/oss-oopssec-store/posts/mcp-malicious-server"}},{"number":34,"title":"npm typosquat","slug":"npm-supply-chain-typosquat","difficulty":"HARD","category":"SUPPLY_CHAIN","estimatedMinutes":{"min":60,"max":90},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-34","chapter":{"index":11,"title":"Supply Chain & Framework","tagline":"Your code is fine. The 800 packages around it aren't.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-11"},"prerequisites":[],"walkthrough":{"slug":"supply-chain-poisoned-rules-chain","title":"Supply Chain & AI Rules File Backdoor: Typosquat → Poisoned Skill → Runtime Backdoor","description":"A two-flag chain that walks an attacker from a developer's stray dev-comment, through a typosquatted npm package, into an AI rules file dropped on disk, ending with a runtime backdoor the AI agent silently injected into the application's admin API.","url":"https://koadt.github.io/oss-oopssec-store/posts/supply-chain-poisoned-rules-chain"}},{"number":35,"title":"AI rules file backdoor","slug":"ai-rules-file-backdoor","difficulty":"MEDIUM","category":"SUPPLY_CHAIN","estimatedMinutes":{"min":20,"max":30},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-35","chapter":{"index":11,"title":"Supply Chain & Framework","tagline":"Your code is fine. The 800 packages around it aren't.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-11"},"prerequisites":[],"walkthrough":{"slug":"supply-chain-poisoned-rules-chain","title":"Supply Chain & AI Rules File Backdoor: Typosquat → Poisoned Skill → Runtime Backdoor","description":"A two-flag chain that walks an attacker from a developer's stray dev-comment, through a typosquatted npm package, into an AI rules file dropped on disk, ending with a runtime backdoor the AI agent silently injected into the application's admin API.","url":"https://koadt.github.io/oss-oopssec-store/posts/supply-chain-poisoned-rules-chain"}},{"number":36,"title":"react2shell (CVE-2025-55182)","slug":"react2shell","difficulty":"HARD","category":"REMOTE_CODE_EXECUTION","estimatedMinutes":{"min":120,"max":null},"url":"https://koadt.github.io/oss-oopssec-store/roadmap#challenge-36","chapter":{"index":11,"title":"Supply Chain & Framework","tagline":"Your code is fine. The 800 packages around it aren't.","url":"https://koadt.github.io/oss-oopssec-store/roadmap#chapter-11"},"prerequisites":[],"walkthrough":{"slug":"react2shell-cve-2025-55182","title":"React2Shell: Exploiting CVE-2025-55182 in React Server Components","description":"A technical analysis of CVE-2025-55182, demonstrating how React Server Components deserialization leads to remote code execution.","url":"https://koadt.github.io/oss-oopssec-store/posts/react2shell-cve-2025-55182"}}]}