Web CTF challenges

2,461 Web CTF challenges from 309 CTFs (2011–2026), 673 with writeups.

Top web techniques

Challenges

Filter and sort these in the challenge browser →

Challenge	CTF	Weight	Has
Novel_reader #double-url-encode-path-traversal	Mapna 2024	24.59	files wu 1
baby_layout #dompurify-bypass #xss	TPCTF 2025	–	files wu 1
safe_layout_revenge #dompurify-bypass #mutation-xss	TPCTF 2025	–	files wu 1
piyosay #dompurify #html-injection	SECCON 2022 Quals	97.90	files wu 1
one_time_read #dom-xss	LINE 2024	–	files wu 1
Image_gallery_2 #dom-clobbering #cache-probing	bi0sCTF 2024	79.83	files wu 1
WhereIsTheScope #dom-clobbering #babel	Glacier 2023	24.32	files wu 1
bb #dom-clobbering	LINE 2022	–	files wu 1
Shisui #dom-clobbering	FwordCTF 2021	24.42	files wu 1
DNXSS_over_HTTPS #dns-txt-record-xss	KalmarCTF 2025	33.89	files wu 1
webwebhookhook #dns-rebinding	IrisCTF 2025	34.30	files wu 1
log4security #deserialization #log-injection	SEETF 2022	–	files wu 1
ParrotOx #deserialization	FwordCTF 2021	24.42	files wu 1
another-secure-store-note #dangling-markup	LINE 2023	–	files wu 1
SeoFtw #cypher-injection	FwordCTF 2021	24.42	files wu 1
jalyboy_jalygirl #cve-2022-21449	LINE 2024	–	files wu 1
raas-v1 #curl-argument-injection #local-file-read #ssrf	ASIS 2022 Finals	87.00	files wu 1
connect #curl-argument-injection #file-exfiltration	TAMUctf 2023	–	files wu 1
Another_Another_CSP #css-injection-leak	justCTF 2024 Quals	77.17	files wu 1
adversal #css-injection #csp-bypass #data-exfiltration	WolvCTF 2023	24.33	files wu 1
Beautiful_Buttons #css-injection #csp	IRON 2024	–	files wu 1
pwnypass #css-injection #browser-extension	UIUCTF 2024	–	files wu 1
Bench_Press #css-injection	Hack.lu 2024	100.00	files wu 1
markdown-plus-plus #css-injection	HSCTF 2022	–	files wu 1
Stylish #css-injection	BCACTF 2021	–	files wu 1
Print_template #csrf #too-many-redirects #sso	m0leCon 2023 Quals	53.62	files wu 1
woeby #csrf #blind-sql-injection	UIUCTF 2022	–	files wu 1
hariboteSecureNote #csp-nonce-bypass	LINE 2022	–	files wu 1
ctf_wiki #csp-img-exfiltration	LA 2024	–	files wu 1
yolo #csp-bypass #predictable-nonce	TJCTF 2023	–	files wu 1
blogme #csp-bypass #dom-clobbering #service-worker	corCTF 2021	24.92	files wu 1
gimme_csp #csp-bypass #content-type-confusion #xss	ASIS 2023 Finals	89.80	files wu 1
eXtra_Safe_Security_layers #csp-bypass	justCTF 2023	53.00	files wu 1
0_CSP #crlf-injection #xss #cache-poisoning	Securinets 2023 Quals	65.42	files wu 1
moraine #crc-collision #adler32 #deduplication	Cryovault 2026 Quals	25.00	files wu 1
Seventh_Core_of_Hell #core-dump-analysis #flask	TAMUctf 2021	–	files wu 1
Secret_Notes #cookie-tossing	IRON 2024	–	files wu 1
clawcha #cookie-parser #json-cookie #signed-cookie	LA 2026	–	files wu 1
mathme #cookie-injection #mathjax-xss	corCTF 2021	24.92	files wu 1
The_Block_City_Times #content-type-bypass #xss #spring-actuator	UMassCTF 2026	65.95	files wu 1