$ ctf42

Web CTF challenges

2,461 Web CTF challenges from 309 CTFs (2011–2026), 673 with writeups.

Top web techniques

#xss 70 #sql-injection 41 #ssti 30 #ssrf 26 #prototype-pollution 25 #path-traversal 25 #csp-bypass 23 #command-injection 21 #web 21 #filter-bypass 14 #xs-leak 14 #lfi 12 #rce 12 #race-condition 12 #css-injection 11

Challenges

Filter and sort these in the challenge browser →

Challenge CTF Weight Has
Escatlate_flag_1
#mass-assignment#insecure-role-assignment#broken-access-control
 1753CTF 2025 34.82 files wu 1
ExploitMe
#mass-assignment
 snakeCTF 2025 Quals 36.65 files wu 1
Knight_Connect
#login-link-forgery
 KnightCTF 2025 18.78 files wu 1
Proxyproxy
#lighttpd-proxy-bypass
 Bhackari 2026 – files wu 1
Funny_lfr
#lfi (local-file-inclusion)#race-condition
 SekaiCTF 2024 36.96 files wu 1
delfi
#lfi (local-file-inclusion)#proc-memory-read
 TAMUctf 2021 – files wu 1
LocalCardMaker
#lfi (local-file-inclusion)#php-rce
 THCon 2022 – files wu 1
My_Avatar
#lfi (local-file-inclusion)#php-include#image-polyglot#avif
 Haruulzangi 2026 Quals – files wu 1
msfrognymize
#lfi (local-file-inclusion)#path-traversal#os-path-join
 corCTF 2023 36.97 files wu 1
includers_revenge
#lfi (local-file-inclusion)
 hxp 2021 99.41 files wu 1
textual
#latex-injection#file-read
 BuckeyeCTF 2022 24.81 files wu 1
Exceeding_Knight
#laravel-debug-mode-leak
 KnightCTF 2025 18.78 files wu 1
jalyboy_baby
#jwt-none-algorithm
 LINE 2024 – files wu 1
imagehost
#jwt-kid-path-traversal#rs256-key-confusion#auth-bypass
 b01lers 2024 30.80 files wu 1
Cat_Club
#jwt-algorithm-confusion#ssti#pug
 1337UP 2024 – files wu 1
Bad_JWT
#jwt#signature-forgery#object-constructor-abuse
 SECCON 2023 Quals 100.00 files wu 1
Random
#jwt#secret-leak
 BYUCTF 2024 – files wu 1
empathy
#jwt#pyjwt#algorithm-confusion
 Aero 2022 51.22 files wu 1
junior-jwt
#jwt#algorithm-confusion#rs256-to-hs256
 S4CTF 2021 24.52 files wu 1
Quotify
#jsonp
 Pragyan 2023 24.00 files wu 1
Advanced_JSON_Cutifier
#jsonnet-file-read
 Mapna 2024 24.59 files wu 1
json_analyser
#json-interoperability
 InCTF 2021 70.41 files wu 1
west-side-story
#json-injection
 HSCTF 2023 – files wu 1
babylogin
#json-cookie#xs-search
 cr3 2024 23.96 files wu 1
migraine
#jsfuck#blind-exfiltration
 TAMUctf 2023 – files wu 1
readme
#jsdom-sandbox-escape#vm-escape
 corCTF 2021 24.92 files wu 1
jscripting
#js-proxy#sandbox-escape
 cr3 2024 23.96 files wu 1
dumbforum
#jinja2-ssti
 m0leCon 2022 Quals 36.00 files wu 1
Repeated_Lock
#jinja2-ssti
 MetaRed 2021 – files wu 1
Node_Calculator
#jaxb#java-deserialization#gadget
 BraekerCTF 2024 24.72 files wu 1
Javascript_Puzzle
#javascript-type-coercion#error-based-leak
 WolvCTF 2025 47.25 files wu 1
username_generator
#javascript-scope-pollution#xss
 SEETF 2022 – files wu 1
3rm1
#java-rmi#java-deserialization
 0CTF 2022 100.00 files wu 1
2rm1
#java-rmi#insecure-deserialization#ssrf#jndi
 0CTF 2021 Quals – files wu 1
0FA
#ja3-tls-fingerprint-spoofing
 Balsn 2023 79.09 files wu 1
on_error_resume_next
#integer-overflow#signedness-bug#ignored-errors#golang
 hxp 2025 – files wu 1
ImportedKimchi2
#insecure-deserialization#pickle#file-upload
 HackPack 2022 35.11 files wu 1
Serialies
#insecure-deserialization#java
 SwampCTF 2025 40.40 files wu 1
certified1
#imagemagick#cve-2022-44268#file-read
 WaniCTF 2023 24.99 files wu 1
png-wizard-v2
#imagemagick
 HSCTF 2022 – files wu 1