Web CTF challenges

2,461 Web CTF challenges from 309 CTFs (2011–2026), 673 with writeups.

Top web techniques

Challenges

Filter and sort these in the challenge browser →

Challenge	CTF	Weight	Has
MLWeb #path-traversal #csrf	GCC 2024	–	files wu 1
Awklet #path-traversal #awk-cgi	BuckeyeCTF 2025	–	files wu 1
Sandevistan #path-traversal #arbitrary-file-write	BlueWater 2024	82.00	files wu 1
SSFS #path-traversal	BuckeyeCTF 2024	50.91	files wu 1
BABY_DUCKY_NOTES #path-traversal	TFC 2023	–	files wu 1
photoable #path-traversal	TJCTF 2022	–	files wu 1
gpushop #path-normalization-bypass #proxy-bypass	GoogleCTF 2021	–	files wu 1
CAFE #parser-differential #xss	Codegate 2022 Quals	–	files wu 1
glotq #parser-differential #json-yaml-polyglot #command-injection	LA 2026	–	files wu 1
lookup #parser-differential #java-gadget-chain #commons-scxml	SekaiCTF 2024	36.96	files wu 1
gamblecore #parseint-coercion-bug	LakeCTF 2025 Quals	–	files wu 1
under-construction #parameter-pollution #parser-differential	GoogleCTF 2023	–	files wu 1
Get_your_flag #parameter-pollution #code-review	NOESCAPE 2022	–	files wu 1
simplewaf #parameter-object-injection #file-url-bypass	corCTF 2022	24.92	files wu 1
Data_Explorer #order-by-sql-injection	MapleCTF 2023	24.05	files wu 1
Hambone #oracle #distance-leak	BuckeyeCTF 2022	24.81	files wu 1
hhhhhhhref #open-redirect	LINE 2024	–	files wu 1
Plaid_Party_Planning_IV #ocaml-type-confusion #float-unboxing	PlaidCTF 2021	99.64	files wu 1
Another_Useless_Application #oauth #open-redirect #token-leak	TeamItaly 2023	24.88	files wu 1
A_simple_website #nuxt #path-traversal	TCP1P 2023	97.33	files wu 1
arclbroth #null-byte-injection	LA 2025	–	files wu 1
CandyShop #nosql-injection #ssti	RCTF 2021	–	files wu 1
NoSQL #nosql-injection	BCACTF 2024	–	files wu 1
Warmup #nim-reversing #dynamic-analysis	Securinets 2021 Quals	41.71	files wu 1
SaaS #nginx-server-name-bypass #json-schema-ajv-exploitation	Balsn 2023	79.09	files wu 1
readme #nginx-path-normalization	ImaginaryCTF 2024	49.81	files wu 1
my_first_app #nextjs-source-api-disclosure	Balsn 2022	53.42	files wu 1
use_cache #nextjs #cache-poisoning #json-parser	b01lers 2024	30.80	files wu 1
shippering #name-mangling #ssti	cr3 2024	23.96	files wu 1
Awesomenotes_II #mxss	Hack.lu 2023	94.73	files wu 1
Nice_View_1 #musescore #file-upload	CrewCTF 2024	26.89	files wu 1
findme #mqtt-authorization-bypass	corCTF 2021	24.92	files wu 1
mongolia #mongodb #aggregation-pipeline #filter-bypass	squ1rrel 2026	32.47	files wu 1
mongolia_2 #mongobleed #cve-2025-14847 #memory-disclosure	squ1rrel 2026	32.47	files wu 1
Missing_Out #misconfiguration #log-file-disclosure	UACWS 2022	–	files wu 1
Meme_Gallery #minio #xss	snakeCTF 2024 Quals	24.79	files wu 1
The_Block_City_Times_V2 #mime-type-spoofing #xss #spring-actuator	UMassCTF 2026	65.95	files wu 1
security-scanner #memcache-injection	hxp 2020	94.00	files wu 1
bigbabycode #mceliece #hamming-code #error-correction	SAS 2025 Quals	20.72	files wu 1
Junkiness #mass-assignment #privilege-escalation	TRX 2026	–	files wu 1