Turn your phone sideways

The slides are widescreen. Landscape fills the screen.

The Attacker's Mindset Workshop 3 01 / 09
Workshop 3 of 3 · Cyber Attack Challenge

Prove it. The Challenge.

Teams. Real vulnerabilities. One clock. Everything you learned this week, now you compete.

Mohamed Medjahdi, Cybersecurity Engineer
7-77 Digital Skills Programme · Algérie Télécom SkillsCenter, Saïda

How it works. Simple.

1 · HUNT

Find bugs, your way

No step-by-step. Recon, question every input, exploit. Any order, your pace.

2 · PROVE

Call me over

Raise a hand, show the find, tell me how you got it. I'll give hints as you go.

3 · REPORT

Write it up

A short report per finding: what, steps, impact, fix. That's what pays.

Teams of 2 or 3. No laptop? Pair up. You score on exploit + explain + report, never just the payload.

first · setup5 points

Get your lab running.

Run Juice Shop and open it in Burp. 5 points for a working local setup. When the clock hits zero, I share my address for anyone still stuck.

docker run --rm -p 3000:3000 bkimminich/juice-shop in Burp: localtest.me:3000
SETUP TIME
10:00
your first move

Find the hidden Score Board.

Juice Shop hides a page that tracks every challenge and its points. It isn't in the menu. Find it, and the whole hunt opens up in front of you. That's recon: finding what the site doesn't advertise.

the board is open · hunt freely

Find what you can. Any order. Call me over to score.

Normal XSS make the site run your code (a popup)
10
XSS with real impact expose the victim's session / token
20
SQL injection log in as admin with no password
20
Crack the admin's password decode the token, follow the trail, crack it
25
Read the code Find It + Fix It on a challenge you solved
10

each scored on exploit + explain + report · method bonus up to +10

HUNT TIME
45:00
last · the deliverablereport points

Write your findings.

Pick your best bugs and write a clean report for each: what, steps to reproduce, impact, fix. Use AI to draft, then check every line. This is what a company actually pays for.

whatstepsimpactfix
REPORT TIME
10:00
the whole week, yours to keep

Take it all with you.

Every slide, the setup guide, the payloads, and a full roadmap to keep going, all free, forever. Scan the code and it's yours.

Everything from all three days lives at medjahdi.dev/src

one week. zero to this.

You didn't just learn it. You did it.

Keep the mindset. Follow the roadmap. This was only the beginning.

Thank you. · medjahdi.dev/src