Some challenges were tested with scripts

No authentication. Just access https://ajax.idocker.hacking-lab.com/api/get?id=1

Blind-SQL-injection in username.

XSS via message form. Steal admins session cookie.

SQL injection.

SSRF, bypass filter with 0. Use gopher so that CR/LF is urldecoded.

RCE via cookie-deserialisation.

Use wieners attack due to low private exponent.

Bruteforce keyspace, LSFR has small state.

ROT13

Factorise modulus (whoose factors are smooth) with pollards p-1, then use pohlig-hellman to recover the message.

Bufferoverflow, overwrite return address.

printf vuln. Overwrite GOT entry for exit with an address from libc.

printf vuln, leak string from stack.

build simple ROP chain to call system(sh).

Use bufferoverflow to overwrite return address, use syscall gadget to call sigreturn to set processor state to call execve(/bin/sh)

Just send shellcode.

ltrace

gzip archive at end of image.

obtain offset for roundkeys by reverseengineering the binary then dump key

Runtime decryption, use a debugger.