Web CTF challenges

2,461 Web CTF challenges from 309 CTFs (2011–2026), 673 with writeups.

Top web techniques

Challenges

Filter and sort these in the challenge browser →

Challenge	CTF	Weight	Has
Puzzle #idor #privilege-escalation #info-disclosure	Securinets CTF 2025 Quals	–	files wu 1
LIT_BUGS #idor #enumeration	LexingtonInformaticsTournament 2021	23.87	files wu 1
funnylfi #idna #curl #local-file-read	Ricerca 2023	–	files wu 1
Average_HTTP_3_Enjoyer #http3 #quic	Srdnlen 2025	–	files wu 1
Heritage #http-request-splitting	LINE 2024	–	files wu 1
phpnotes #http-request-smuggling	hxp 2024	–	files wu 1
64bps #http-range-requests	WaniCTF 2023	24.99	files wu 1
Crabby_Clicker #http-pipelining #race-condition	UMassCTF 2024	43.10	files wu 1
denied #http-method	AmateursCTF 2024	24.54	files wu 1
Sticky_Notes #http-desync #unicode-length-mismatch	CircleCityCon 2021	25.00	files wu 1
Flags #html-injection #css-injection #csp-bypass #data-exfiltration	Zh3r0 2021	–	files wu 1
COOKIE_STORE #html-injection	TFC 2023	–	files wu 1
steps_to_success #htaccess #header-spoofing	Pearl 2024	23.95	files wu 1
Ez #host-header-path-injection	KalmarCTF 2023	24.21	files wu 1
vault #header-whitespace-normalization #admin-bot #auth-bypass	pingCTF 2022	24.29	files wu 1
BioCorp #header-ip-spoofing #access-control-bypass #xxe	1337UP 2024	–	files wu 1
Wordle #hash-precomputation #unsalted-md5	BYUCTF 2022	–	files wu 1
Intellimage #hash-length-extension #exiftool-rce	BSidesTLV 2021	23.94	files wu 1
Postviewer_v3 #hash-collision #xss	GoogleCTF 2024	–	files wu 1
Shopping_Time #hash-collision	TU 2024	–	files wu 1
Repository_Security #hardcoded-credentials #git-leak	BxMCTF 2023	–	files wu 1
graphql_101 #graphql-batching-bypass	LINE 2024	–	files wu 1
Proxy_For_Life #go-pprof #info-leak	Akasec 2024	23.15	files wu 1
GitBad #git-submodule-hook-rce	L3akCTF 2025	24.43	files wu 1
clankers_market #git-filter-rce #git-dumper #suid	b01lers 2026	66.00	files wu 1
near_miss #fuzzy-match-oracle #oracle-attack	Cryovault 2026 Quals	25.00	files wu 1
Bypassssss #fragmented-sql-injection #lfi (local-file-inclusion)	TCP1P 2023	97.33	files wu 1
Tommys_Artventures #flask-session-forgery	USC 2024	–	files wu 1
pwnhub #flask #ssti #filter-bypass	b01lers 2024	30.80	files wu 1
Duck_Nettool_Revenge #filter-bypass #glob-expansion #command-injection	V1T 2026	22.14	files wu 1
Art_Contest #file-upload #php-filter-bypass #suid	WolvCTF 2025	47.25	files wu 1
resonator #fastcgi-ssrf	hxp 2020	94.00	files wu 1
secretclub #express-parameter-limit	cr3 2024	23.96	files wu 1
ruthless_monster #exiftool #cve-2021-22204 #djvu #polyglot-file	Pwn2Win 2021	83.41	files wu 1
JUJUTSU_KAISEN_2 #esi-injection	MapleCTF 2023	24.05	files wu 1
ns_shaft_sql #error-based-sqli #mysql	RCTF 2021	–	files wu 1
urmombotnetdotnetcom_1 #error-based-info-disclosure #duplicate-registration	BYUCTF 2023	–	files wu 1
Forgotten_Password #email-header-injection	TAMUctf 2024	–	files wu 1
Telechat #electron #rce	HeroCTF 2024	–	files wu 1
xss_it #ejs-ssti #xss #xs-leak	RCTF 2021	–	files wu 1