The Attacker's Mindset (Part 3/3): Running a 45-Minute Cyber Attack Challenge

Part 3 of 3: the final session of the offensive security training I gave at the Algérie Télécom Skills Center in Saïda (7-77 Digital Skills Programme). Part 1 was the mindset, part 2 the hands-on lab. This is where everyone had to prove it.

No lectures. Just targets, a scoreboard and a clock.

The rules

Teams of 2 or 3 (no laptop? pair up), and three phases, each on a timer.

1. Setup: 10 minutes. Get Juice Shop running and open it through Burp. A working local lab earned the first points.

docker run --rm -p 3000:3000 bkimminich/juice-shop

2. Hunt: 45 minutes. No step-by-step. Recon, question every input, exploit, in any order, at your own pace. Found something? Raise a hand, show it, and explain how you got there.

3. Report: 10 minutes. Pick your best findings and write a short report for each.

First move: recon

Juice Shop hides a Score Board that tracks every challenge and its points. It isn't in the menu. Finding it is the first real task, and it's recon in its purest form: discovering what the site doesn't advertise. Once a team found it, the whole hunt opened up.

What teams hunted

• Normal XSS: make the site run your code (a popup).
• XSS with real impact: go past the popup and expose the victim's session token.
• SQL injection: log in as admin with no password.
• Crack the admin's password: decode the token, follow the trail, crack it.
• Read the code: on a challenge you solved, find the vulnerable line and write the fix.

How scoring worked

Every finding was scored on three things: exploit + explain + report, never on the payload alone, with a bonus for clean methodology.

That was deliberate. In a real job nobody pays for a payload that works by accident. They pay for someone who can explain why it works and how to fix it.

The deliverable: the report

Each report had four parts:

1. What: the vulnerability, in one sentence.
2. Steps: exactly how to reproduce it.
3. Impact: what an attacker gains.
4. Fix: what the developer should change.

AI was allowed for drafting, with one rule: check every line before you submit it.

One week, zero to this

That was the arc of the week. Day 1: understand how attackers think. Day 2: find bugs by hand. Day 3: find, prove and report them as a team, against the clock.

Everything from all three days stays online and free for anyone who wants to keep going:

• 🔗 Workshop 3 challenge deck: https://medjahdi.dev/src/workshop-3
• 🎁 All slides, setup guides, payloads and the roadmap: https://medjahdi.dev/src
• ⭐ GitHub repository: https://github.com/medjahdi/skills-center-gift

Thanks to the team at the Algérie Télécom Skills Center in Saïda for hosting it.

Keep the mindset. Follow the roadmap. This was only the beginning.