Challenge list
Web SecurityLevel 1★☆☆☆☆05. HTML Source Code Secret
Web pages contain a lot of information that isn't visible on the surface. Looking at HTML source code, you can often…
Web SecurityLevel 1★☆☆☆☆06. JavaScript Password Check
This page has a password-protected area. However, because the password check is done in JavaScript, you can find the…
Web SecurityLevel 1★☆☆☆☆07. Peek at Cookies
Websites use a mechanism called cookies to store information in your browser. They're used for managing login states,…
Network SecurityLevel 1★☆☆☆☆08. Network Basics - Learn Port Numbers
Networks use port numbers to identify services. For example, a web server (HTTP) usually uses port 80, and encrypted…
Web SecurityLevel 1★☆☆☆☆SQL Injection 101
This login form has an SQL Injection vulnerability. Log in as admin without proper credentials and retrieve the flag.
Web SecurityLevel 1★☆☆☆☆Web-04. The robots.txt Trap
Websites often serve a robots.txt file for crawlers. In this challenge, check whether a file that robots.txt tells…
Web SecurityLevel 1★☆☆☆☆Web-05. Directory Listing Trap
When an Nginx server has directory index listing (autoindex) enabled, anyone can browse the full file listing of a…
Web SecurityLevel 1★☆☆☆☆Web-06. Forging HTTP Headers
This application grants access based on the value of a specific HTTP header. Even values the browser never sends by…
Web SecurityLevel 1★☆☆☆☆Web-07. Tampering with URL Parameters
This web application checks the value of the GET parameter key on the server side. The required parameter name and…
Web SecurityLevel 1★☆☆☆☆Web-08. Tampering with POST Data
The login form contains a hidden input field that is invisible in the rendered page. Inspect it with developer tools…
Web SecurityLevel 1★☆☆☆☆Web-09. The Weak Basic Auth Trap
A protected area is guarded by HTTP Basic Authentication, but the developer accidentally left the credentials in an…
Web SecurityLevel 1★☆☆☆☆Web-10. Peeking Behind a Redirect
Accessing a certain page immediately redirects you elsewhere. Browsers automatically follow redirects, so think about…
Web SecurityLevel 1★☆☆☆☆XSS Basics - Guestbook
This web application has a basic XSS vulnerability. Find where input is reflected in the guestbook. The flag is at an…
Web SecurityLevel 2★★☆☆☆Web-11. SQL Injection into the Employee Portal
KinoGadget's internal "Employee Access Portal" runs on a legacy authentication system. The lead developer is rumored…
Web SecurityLevel 2★★☆☆☆Web-12. Reflected XSS in BlogSearch
BlogSearch is a simple search engine for blog articles. The search query is embedded into the results page as-is…
Web SecurityLevel 2★★☆☆☆Web-13. Bypassing File Upload Checks in ImageVault
ImageVault is an image hosting service that accepts JPG, PNG, and GIF uploads. If its validation only checks the end…
Web SecurityLevel 2★★☆☆☆Web-14. Command Injection in a Network Diagnostic Tool
This app is a diagnostic tool that runs ping against a host you supply. If the host input is passed straight into a…
Web SecurityLevel 2★★☆☆☆Web-15. IDOR in the UserProfile Service
The UserProfile Service exposes an API that returns profile information for a given user ID. Check whether the service…
Web SecurityLevel 2★★☆☆☆Web-16. Weak JWT Secret in the CHIMERA Research Lab
Clues found after breaching the employee portal point to an isolated research lab system codenamed CHIMERA. It…
Web SecurityLevel 2★★☆☆☆Web-17. Path Traversal in FileShare
FileShare lets users list and download files from a shared folder. Check whether the filename parameter passed to the…
Web SecurityLevel 2★★☆☆☆Web-18. XXE Attack via a Contact Form
This contact form serializes its input as XML and sends it to the server, which parses it and echoes the result.…
Web SecurityLevel 2★★☆☆☆Web-19. CSRF Transfer in a Banking App
This banking app lets a logged-in user transfer money. Check whether CSRF protections exist by seeing if a separate…
Web SecurityLevel 2★★☆☆☆Web-20. SSRF via the URL Fetcher
This URL Fetcher service retrieves and displays the content of any URL a user provides. Check whether it can be…
Network SecurityLevel 2★★☆☆☆Network Analysis - DNS Zone Transfer Leak
An unauthenticated DNS zone transfer (AXFR) against a misconfigured authoritative server was captured. Download the…