$ ctf42

Web CTF challenges

2,461 Web CTF challenges from 309 CTFs (2011–2026), 673 with writeups.

Top web techniques

#xss 70 #sql-injection 41 #ssti 30 #ssrf 26 #prototype-pollution 25 #path-traversal 25 #csp-bypass 23 #command-injection 21 #web 21 #filter-bypass 14 #xs-leak 14 #lfi 12 #rce 12 #race-condition 12 #css-injection 11

Challenges

Filter and sort these in the challenge browser →

Challenge CTF Weight Has
BLADE_RUNNER
#prototype-pollution
 MapleCTF 2023 24.05 files wu 1
Mini_Survey
#prototype-pollution
 niteCTF 2023 – files wu 1
Zap
#prototype-pollution
 DownUnderCTF 2021 – files wu 1
fancy-notes
#prototype-pollution
 idekCTF 2021 24.56 files wu 1
venmo_me_67
#prompt-injection#llm
 b01lers 2026 66.00 files wu 1
Pwning_en_Logique
#prolog#format-string-injection
 ImaginaryCTF 2024 49.81 files wu 1
md-notes
#postmessage-xss
 InCTF 2021 70.41 files wu 1
PlantUML
#plantuml#file-read
 SEETF 2023 – files wu 1
File_Store
#pickle-deserialization
 KalmarCTF 2024 24.21 files wu 1
Jar
#pickle#deserialization
 angstromCTF 2021 – files wu 1
Layers_of_Lies
#php-wrappers
 JerseyCTF 2025 24.73 files wu 1
cakegear
#php-type-juggling#auth-bypass
 CakeCTF 2022 – files wu 1
Certay
#php-signature-forgery
 L3akCTF 2025 24.43 files wu 1
Memory
#php-session-upload-progress
 IJCTF 2021 – files wu 1
Upload_it
#php-session-deserialization#pop-chain
 SCTF 2021 – files wu 1
Upload_it_2
#php-session-deserialization#pop-chain
 SCTF 2021 – files wu 1
Sourceful_Guessless_Web
#php-ini-injection
 SEETF 2023 – files wu 1
ProgrammersHateProgramming_2
#php-filter-bypass#nested-keyword-bypass#php-code-injection
 PBjar 2021 23.18 files wu 1
php_sucks
#php-file-upload-bypass#strtok-filename-truncation#rce
 BackdoorCTF 2023 – files wu 1
certay_revenge
#php-eval-filter-bypass
 L3akCTF 2025 24.43 files wu 1
digestif
#php-digest-auth
 LakeCTF 2023 Quals – files wu 1
Un_Secure
#php-deserialization#pop-chain
 TCP1P 2023 97.33 files wu 1
journal
#php-assert-injection#rce
 ImaginaryCTF 2024 49.81 files wu 1
Just_Not_My_Type
#php#strcmp-type-juggling
 KillerQueen 2021 21.14 files wu 1
PHat_Pottomed_Girls
#php#filter-bypass#code-injection
 KillerQueen 2021 21.14 files wu 1
php.galf
#php#class-injection
 b01lers 2023 36.84 files wu 1
phpotato
#php
 snakeCTF 2023 – files wu 1
readonly
#php
 SEETF 2023 – files wu 1
Upload
#pdfjs#cve-2024-4367#xss
 Akasec 2024 23.15 files wu 1
Invoiced
#pdf-bot#ssrf#cookie-bypass
 KalmarCTF 2023 24.21 files wu 1
Big Data
#pcap-analysis#telnet
 CSAW 2014 Quals – files wu 1
frenzy_flask
#pathlib-joinpath#arbitrary-file-write
 GCC 2024 – files wu 1
online-library
#path-traversal-lfi
 LINE 2022 – files wu 1
Secure_Storage
#path-traversal#xor#known-plaintext
 NexHunt 2025 – files wu 1
Borraccia
#path-traversal#rce
 TeamItaly 2023 24.88 files wu 1
CaveFilePaths
#path-traversal#non-recursive-filter-bypass
 UIUCTF 2026 – files wu 1
just_download_it
#path-traversal#lfi (local-file-inclusion)
 VuwCTF 2026 25.00 files wu 1
vikeMERCH
#path-traversal#go-path-clean
 vikeCTF 2024 23.64 files wu 1
ProfileEditor
#path-traversal#flask
 PwnMe 2025 Quals 24.95 files wu 1
Pearl_U-Stor
#path-traversal#cygwin#symlink
 PlaidCTF 2021 99.64 files wu 1