Web CTF challenges

2,454 Web CTF challenges from 308 CTFs (2011–2026), 449 with writeups.

Top web techniques

Challenges

Filter and sort these in the challenge browser →

Challenge	CTF	Weight	Has
metaverse #xss-csrf-chain	LA 2023	–	files wu 3
simple_blog #xss #csp-bypass #trusted-types	zer0pts 2021	24.56	files wu 3
zombie-101 #xss #cookie-theft	WolvCTF 2023	24.33	files wu 3
Based_Encoding #xss	Hack.lu 2023	94.73	files wu 3
fancy-page #xss	HSCTF 2023	–	files wu 3
WebUtils #web #xss #nodejs #cookie-theft	DiceCTF 2021	24.82	files wu 3
MissingFlavortext #web #sqlite-injection #type-juggling #filter-bypass	DiceCTF 2021	24.82	files wu 3
funnylogin #web #sql-injection #prototype-pollution #type-confusion	DiceCTF 2024 Quals	54.40	files wu 3
build-a-panel #web #sql-injection #nodejs #admin-bot	DiceCTF 2021	24.82	files wu 3
Gatekeeping #web #nginx-gunicorn-path-bypass #access-control-bypass	CSAW 2021 Quals	20.54	files wu 3
WebIDE #web #js-sandbox-escape #service-workers #cookie-path-bypass	DiceCTF 2021	24.82	files wu 3
knock-knock #web #hmac-forgery #predictable-secret #nodejs	DiceCTF 2022	24.82	files wu 3
BabierCSP #web #csp-bypass #xss #cookie-theft	DiceCTF 2021	24.82	files wu 3
AgentTester #union-sql-injection	NahamCon 2021	24.98	files wu 3
Upside_down_cake #type-confusion #javascript	TSG 2023	–	files wu 3
super-secure-translation-implementation #ssti #jinja2 #filter-bypass	DamCTF 2021	24.43	files wu 3
valentine #ssti	hxp 2022	–	files wu 3
Build-A-Website #ssti	ImaginaryCTF 2021	–	files wu 3
go-gopher #ssrf #gopher-protocol	AmateursCTF 2023	24.54	files wu 3
ContrivedWebProblem #ssrf #ftp-crlf-injection #rabbitmq #nodemailer-attachment	PlaidCTF 2020	93.15	files wu 3
Log_Action #ssrf #cve-2024-34351	UIUCTF 2024	–	files wu 3
la_housing_portal #sql-injection	LA 2024	–	files wu 3
blank #sql-injection	ImaginaryCTF 2023	34.52	files wu 3
game-leaderboard #sql-injection	TJCTF 2022	–	files wu 3
Movie-Login-2 #sql-injection	BCACTF 2021	–	files wu 3
Movie-Login-3 #sql-injection	BCACTF 2021	–	files wu 3
shitty_blog #sql-injection	hxp 2021	99.41	files wu 3
SaaS #sed-command-injection	ImaginaryCTF 2021	–	files wu 3
Personnel #regex-injection	NahamCon 2022	24.61	files wu 3
illusion #prototype-pollution #rce	Pwn2Win 2021	83.41	files wu 3
Custom_Blog #php-session-lfi-rce	MetaCTF 2021	–	files wu 3
CerealAndMilk #php-object-injection	NahamCon 2021	24.98	files wu 3
Etulosba #path-traversal	Intent 2021	19.97	files wu 3
hackme #parser-differential	hxp 2020	94.00	files wu 3
mogodb #nosql-injection	HSCTF 2023	–	files wu 3
kantan_calc #nodejs #vm-escape #sandbox-escape	zer0pts 2021	24.56	files wu 3
buyme #mass-assignment #object-spread-injection	corCTF 2021	24.92	files wu 3
funny_factorials #lfi (local-file-inclusion)#path-normalization-bypass #flask	AmateursCTF 2023	24.54	files wu 3
unzipper #lfi (local-file-inclusion)	hxp 2021	99.41	files wu 3
Cr0wnAir #jwt #algorithm-confusion	Union 2021	24.34	files wu 3