Scratch is a programming language and IDE targeted at teaching young children how to code. The environment is sprite-based with all code residing behind each of the sprites and the stage (background). It is particularly good at developing games not unlike the flash-based games of the 90s/00s. Typically, the Scratch environment is a sandbox limiting all actions to objects within its own world. With the offline version of Scratch v2, however, it is possible to load ‘experimental HTTP extensions’ that can introduce new blocks linked to python functions via a web service API.Using the experimental extensions, I have implemented a set of blocks that allow access to TCP/IP functions. With these blocks it is possible to fuzz and exploit vulnerable services on a network-accessible victim machine. As a demonstration I have developed a PoC for the web server running on Saumil Shah’s tinysploit (stack smash) plus PoCs for two echo servers I have added to it (stack smash and format string vulnerability).The aims of the talk are to show that the (supposedly) sandboxed Scratch can be used to send evil packets to the network, and also to show that fuzzing and building exploits doesn’t have to involve coding abilities beyond those required to develop in Scratch. In other words, if you (or your child) wishes to learn how to write your own exploits, then this is all possible with Scratch and my experimental extension.The talk will cover the intricacies of the Scratch extension API and the limitations that need to be overcome to make it usable, plus how these simple concepts can be strung together to create exploits.