Exploiting a zero-day SQL injection

Exploiting CBC-mode encryption and messy JSON parsers

Exploiting open Websockets

Exploiting a webserver using only python modules

Padding oracle with extra steps?