What you will learn
- Read HTTP requests and responses
- Understand why common web vulnerabilities occur
- Connect exploitation techniques to secure implementation
Hands-on Web Security CTF Challenges
Learn HTTP, authentication, input validation, and common web vulnerabilities in isolated practice environments.
Web Security challenges
32 challenges available.
WebLevel 3Web-23. Type Juggling in the Secure Authentication System
This login portal supports form login, a JSON API login, and a verification-code check. The admin account's real…
WebLevel 3Web-24. Exploiting a Race Condition in Secure Bank
Secure Bank lets users spend a coin balance on shop prizes. If the balance check and the deduction happen as two…
WebLevel 3Web-25. SSTI in the Greeting Card Generator
This greeting card generator is built with Flask/Jinja2 and renders the user's message directly through the template…
WebLevel 4Web-26. Prototype Pollution in User Profile Manager
In this Node.js/Express app, a logged-in user can update their own profile. Check whether the recursive merge function…
WebLevel 4Web-27. GraphQL Introspection Leak
This GraphQL API exposes a schema of User objects with introspection enabled. Investigate whether undocumented queries…
WebLevel 4Web-28. Hijacking an OAuth Authorization Code
This OAuth 2.0 authorization provider offers a login flow, but its redirect_uri validation may be weak. Investigate…
WebLevel 4Web-29. NoSQL Injection in a MongoDB Login Form
This login portal is backed by MongoDB and builds its query directly from raw JSON username/password input.…
WebLevel 4Web-30. Insecure Deserialization in KinoVault
A legacy backup system codenamed KinoVault reportedly serializes user session objects with Python's pickle module and…