What you will learn
- Read HTTP requests and responses
- Understand why common web vulnerabilities occur
- Connect exploitation techniques to secure implementation
Hands-on Web Security CTF Challenges
Learn HTTP, authentication, input validation, and common web vulnerabilities in isolated practice environments.
Web Security challenges
32 challenges available.
Web Level 3 Web-23. Type Juggling in the Secure Authentication System
This login portal supports form login, a JSON API login, and a verification-code check. The admin account's real…
Web Level 3 Web-24. Exploiting a Race Condition in Secure Bank
Secure Bank lets users spend a coin balance on shop prizes. If the balance check and the deduction happen as two…
Web Level 3 Web-25. SSTI in the Greeting Card Generator
This greeting card generator is built with Flask/Jinja2 and renders the user's message directly through the template…
Web Level 4 Web-26. Prototype Pollution in User Profile Manager
In this Node.js/Express app, a logged-in user can update their own profile. Check whether the recursive merge function…
Web Level 4 Web-27. GraphQL Introspection Leak
This GraphQL API exposes a schema of User objects with introspection enabled. Investigate whether undocumented queries…
Web Level 4 Web-28. Hijacking an OAuth Authorization Code
This OAuth 2.0 authorization provider offers a login flow, but its redirect_uri validation may be weak. Investigate…
Web Level 4 Web-29. NoSQL Injection in a MongoDB Login Form
This login portal is backed by MongoDB and builds its query directly from raw JSON username/password input.…
Web Level 4 Web-30. Insecure Deserialization in KinoVault
A legacy backup system codenamed KinoVault reportedly serializes user session objects with Python's pickle module and…