Challenge list

05. HTML Source Code Secret

Web pages contain a lot of information that isn't visible on the surface. Looking at HTML source code, you can often…

06. JavaScript Password Check

This page has a password-protected area. However, because the password check is done in JavaScript, you can find the…

07. Peek at Cookies

Websites use a mechanism called cookies to store information in your browser. They're used for managing login states,…

ProgrammingLevel 1★☆☆☆☆

09. Python Automation - File Reading

In security work, programming is essential for processing large amounts of data. In this challenge, you'll use Python…

CryptographyLevel 1★☆☆☆☆

11. Decode the Caesar Cipher

The Caesar cipher is one of the oldest classical ciphers used by Julius Caesar. It encrypts by shifting alphabet…

CryptographyLevel 1★☆☆☆☆

14. ROT13 Magic

ROT13 (Rotate 13) is a type of Caesar cipher that shifts the alphabet by 13 letters. Interesting feature of ROT13:…

SQL Injection 101

This login form has an SQL Injection vulnerability. Log in as admin without proper credentials and retrieve the flag.

45 ptsOpen challenge

Web-04. The robots.txt Trap

Websites often serve a robots.txt file for crawlers. In this challenge, check whether a file that robots.txt tells…

Web-05. Directory Listing Trap

When an Nginx server has directory index listing (autoindex) enabled, anyone can browse the full file listing of a…

Web-06. Forging HTTP Headers

This application grants access based on the value of a specific HTTP header. Even values the browser never sends by…

Web-07. Tampering with URL Parameters

This web application checks the value of the GET parameter key on the server side. The required parameter name and…

Web-08. Tampering with POST Data

The login form contains a hidden input field that is invisible in the rendered page. Inspect it with developer tools…

Web-09. The Weak Basic Auth Trap

A protected area is guarded by HTTP Basic Authentication, but the developer accidentally left the credentials in an…

Web-10. Peeking Behind a Redirect

Accessing a certain page immediately redirects you elsewhere. Browsers automatically follow redirects, so think about…

XSS Basics - Guestbook

This web application has a basic XSS vulnerability. Find where input is reflected in the guestbook. The flag is at an…

35 ptsOpen challenge

CryptographyLevel 2★★☆☆☆

AES-ECB Mode Weakness

ECB leaks repeated block patterns. This introductory task first checks the difference between encryption and encoding.…

65 ptsOpen challenge

API Requests - Find the Highest-Profit Trade

When the container starts, a stock API begins running on http://localhost:9102 (you do not need to start server.py).…

Python Practice - Bulk Base64 Stream Decoding

Every line of data.txt (about 150 lines, created at every start) is Base64. Decode line by line; when the result…

Python Practice - Conditional CSV Sales Filtering

data.txt, created at every start, is a sales CSV (transaction_id,date,product_id,amount,status,ref,notes). Several…

Python Practice - Compound JSON User Query

Examine the JSON data.txt ({"users": [...]}) created at every start. Each user has id, name, email, role, active and…

Python Practice - Target-IP Access Log Tracing

data.txt (about 1,300 lines, created at every start) is a web server access log. Extract only the requests from…

Python Automation - Bulk Base64 Decoding

Every line of data.txt (about 150 lines, created at every start) is Base64. Decode line by line; when the result…

40 ptsOpen challenge