Operation Bits n Bites
Beginner to breach in six hours. Hack a food-delivery app, follow the money, name the bank.
Advanced SQL injection attacks in complex autorisation scenario's
Self-paced. Lifetime access to the track.
No setup. Runs entirely in your browser.
- Time to complete ~6 hours
- Challenges 13
- Phases 5
- OWASP categories 6
- Skill level Hard
- Format Hands-on lab
- Domain Mobile / WebView
- Language English
Questions about the track?
Talk to the teamWhat you'll learn
One food-delivery app. Thirteen ways in. You leave able to spot every flaw you exploited in your own code, and to close it.
Operation Bits n Bites drops you inside Sine Nomine, a hacker collective tracing a laundering ring through a food-delivery app. It is one continuous attack chain: thirteen challenges, each handing you the foothold for the next, so you feel how small, realistic mistakes compound into a full breach.
The target is a hybrid WebView app, the same surface behind React Native, Cordova, Ionic/Capacitor and Flutter, and you run the whole operation from your browser. No emulator, no rooted device, no Kali VM. Six hours from now you think like the attacker your code has to survive.
Blind SQL injection, from confirmed to fully extracted
The database returns no output and no errors, so your developers learn to make it talk anyway: they ask it a stream of true or false questions and read the answer from how the app behaves. This module maps straight to A05:2025 Injection and takes a team from spotting an injectable field to lifting an admin password one character at a time.
What your developers can do after it
Three oracles, six challenges
Flip the result set with a tautology against a contradiction (AND 1=1 versus AND 1=2) to prove an input is injectable when nothing is returned.
Turn a conditional database error into a yes or no oracle, then binary-search a hidden value such as the user row count.
Gate a conditional SLEEP on a secret so response delay becomes the leak channel, recovering the admin password one character at a time.
Why it matters
Suppressing query output is not a defence. Anything the database account can read is still exfiltratable through behavioural and timing side-channels, which walks straight past output filtering and many WAF rules.
- Full database enumeration, then theft of credentials and personal data.
- Binary search recovers unknown values in O(log N) requests, so blind extraction is fast, not theoretical.
- Time-based variants leave only anomalous response times, so they slip past detection, and tools like sqlmap automate the whole chain.
The operation, phase by phase
One continuous attack chain, five phases deep. Each phase hands you the foothold for the next. Follow the spine top to bottom.
Account recon
Find the suspects, confirm the account.
Every breach opens with reconnaissance. You mine data the target never meant to expose, then read how the login flow answers to confirm exactly whose account you are hunting. You leave this phase with a live target locked in, and no password touched yet.
- A01 Broken Access Control: sensitive information exposed to an unauthorized actor.
- A07 Authentication Failures: account enumeration, and why reused breach data enables credential-stuffing recon.
- Query a public Azure Table Storage endpoint with OData $filter, eq and and operators.
- Read the login response to tell a registered account from a fake one.
Infiltration
Get a foothold, find the hidden MFA field.
With your own foothold inside, you look for the seam. Sensitive identifiers the interface hides still travel across the wire, and a vulnerable search field lets you reach them through blind SQL injection. This is where server-side trust in user input first breaks, and where you learn to extract data the app was built to conceal.
- A01 Broken Access Control: sensitive fields exposed in API request payloads.
- A05 Injection: boolean-based blind SQL injection.
- Spot a hidden or greyed-out field that is still present in the request body.
- Close a string with a quote, inject conditions, comment out the rest, and binary-search a numeric value.
Account takeover
Reroute the target's MFA, then reset the password.
One over-trusting endpoint hands you the account. Weak ownership checks let you redirect the target's multi-factor authentication to yourself, then the password-reset flow does the rest. It is a clean lesson in how a single mass-assignment flaw collapses an entire account's defences.
- A07 Authentication Failures: an MFA flow that trusts an attacker-controlled pointer.
- A08 Software and Data Integrity Failures: mass assignment and polymorphic over-posting (CWE-915).
- Over-post a field the API never meant to accept, on a record you do not own.
- Hijack the MFA binding to intercept a reset code and take the account.
Lateral movement
Pivot from the customer to the driver.
One account is never the finish line. You pivot from the customer to a higher-value operator on the platform, chaining injection, broken access control and weak client-side cryptography to defeat their multi-factor protection. This is how a lone foothold becomes deep, cross-account access.
- A01 Broken Access Control: insecure direct object reference (IDOR).
- A04 Cryptographic Failures: a hard-coded client-side key (CWE-321).
- A05 Injection: blind SQL injection keyed on non-email fields.
- A07 Authentication Failures: a compromised TOTP seed.
- Binary-search a value through name-based blind SQL injection.
- Read another user's record by changing an id on an unprotected endpoint.
- Recover a static AES key from client JavaScript and decrypt protected data.
- Generate valid time-based codes from a leaked shared secret.
Exfiltration
Reach the vendor, then the internal ledger.
The finale reaches past the app into the systems behind it. Filter-bypassing injection and server-side request forgery open a path to internal financial data, and one forgotten trace in client-side storage names the bank at the centre of the operation. You finish seeing how separate, ordinary flaws combine into a full breach.
- A01 Broken Access Control: server-side request forgery (SSRF).
- A02 Security Misconfiguration: sensitive data left in client-side storage.
- A05 Injection: stored XSS past naive sanitisation, plus XXE.
- Bypass exact-match filters with case and encoding variation to land stored XSS.
- Turn an XML external entity into an SSRF read of an internal service.
- Recover deleted data from local and session storage.
OWASP Top 10 (2025) coverage
Six of the ten categories, exploited for real against a realistic app.
- Exploit insecure direct object references to access MFA settings belonging to other users.
- Abuse mass assignment vulnerabilities to overwrite account ownership fields the API was never meant to expose.
- Leverage server-side request forgery through XML external entity injection to reach internal services.
- Recover supposedly deleted messages from browser localStorage that the platform forgot to clear, revealing the name of the bank behind the laundering operation.
- Recover hardcoded encryption keys left in client-side JavaScript and use them to decrypt protected driver metadata.
- Execute boolean-based blind SQL injection against the restaurant search endpoint. Results appear or vanish depending on injected conditions, leaking data the UI was built to hide.
- Bypass weak sanitisation filters using case-variation payloads to deliver stored XSS through the driver-vendor chat, stealing authentication tokens in real time.
- Craft XXE payloads that turn an XML export feature into a gateway to internal financial ledgers.
- Enumerate valid accounts by observing how the login flow responds differently to registered and unregistered users.
- Hijack MFA flows by redirecting second-factor challenges to an attacker-controlled account, then use the intercepted codes to reset the target's password and take full control.
- Exploit a generic update endpoint that blindly attaches posted objects without validating ownership, enabling full MFA hijacking through a single crafted request.
At a glance
- Time to complete~6 hours
- Challenges13
- Phases5
- OWASP categories6
- Skill levelHard
- FormatHands-on lab
- DomainMobile / WebView
- LanguageEnglish
What's included
- 13 hands-on challenges, played as one continuous attack chain
- Authored hints that unstick you without spoiling the win
- Every finding mapped to the OWASP Top 10 (2025)
- Runs entirely in your browser, no emulator or Kali VM
- Certificate on completion
- Lifetime access to the track