Hands-on Web Security CTF Challenges

05. HTML Source Code Secret

Web pages contain a lot of information that isn't visible on the surface. Looking at HTML source code, you can often…

06. JavaScript Password Check

This page has a password-protected area. However, because the password check is done in JavaScript, you can find the…

07. Peek at Cookies

Websites use a mechanism called cookies to store information in your browser. They're used for managing login states,…

SQL Injection 101

This login form has an SQL Injection vulnerability. Log in as admin without proper credentials and retrieve the flag.

45 ptsOpen challenge

Web-04. The robots.txt Trap

Websites often serve a robots.txt file for crawlers. In this challenge, check whether a file that robots.txt tells…

Web-05. Directory Listing Trap

When an Nginx server has directory index listing (autoindex) enabled, anyone can browse the full file listing of a…

Web-06. Forging HTTP Headers

This application grants access based on the value of a specific HTTP header. Even values the browser never sends by…

Web-07. Tampering with URL Parameters

This page checks a URL GET parameter's value using client-side JavaScript and reveals a flag when the condition is…

Web-08. Tampering with POST Data

The login form contains a hidden input field that is invisible in the rendered page. Inspect it with developer tools…

Web-09. The Weak Basic Auth Trap

A protected area is guarded by HTTP Basic Authentication, but the developer accidentally left the credentials in an…

Web-10. Peeking Behind a Redirect

Accessing a certain page immediately redirects you elsewhere. Browsers automatically follow redirects, so think about…

XSS Basics - Guestbook

This web application has a basic XSS vulnerability. Find where input is reflected in the guestbook and retrieve the…

35 ptsOpen challenge

Web-11. SQL Injection into the Employee Portal

KinoGadget's internal "Employee Access Portal" runs on a legacy authentication system. The lead developer is rumored…

Web-12. Reflected XSS in BlogSearch

BlogSearch is a simple search engine for blog articles. The search query is reflected back on the results page — check…

40 ptsOpen challenge

Web-13. Bypassing File Upload Checks in ImageVault

ImageVault is an image hosting service that accepts JPG, PNG, and GIF uploads. If its validation only checks the end…

Web-14. Command Injection in a Network Diagnostic Tool

This app is a diagnostic tool that runs ping against a host you supply. If the host input is passed straight into a…

Web-15. IDOR in the UserProfile Service

The UserProfile Service exposes an API that returns profile information for a given user ID. Check whether the service…

Web-16. Weak JWT Secret in the CHIMERA Research Lab

Clues found after breaching the employee portal point to an isolated research lab system codenamed CHIMERA. It…

60 ptsOpen challenge

Web-17. Path Traversal in FileShare

FileShare lets users list and download files from a shared folder. Check whether the filename parameter passed to the…

Web-18. XXE Attack via a Contact Form

This contact form serializes its input as XML and sends it to the server, which parses it and echoes the result.…

Web-19. CSRF Transfer in a Banking App

This banking app lets a logged-in user transfer money. Check whether CSRF protections exist by seeing if a separate…

Web-20. SSRF via the URL Fetcher

This URL Fetcher service retrieves and displays the content of any URL a user provides. Check whether it can be…