Web CTF challenges

2,461 Web CTF challenges from 309 CTFs (2011–2026), 673 with writeups.

Top web techniques

Challenges

Filter and sort these in the challenge browser →

Challenge	CTF	Weight	Has
dummyhole #content-type-bypass #path-traversal #ssrf	SECCON 2025 Quals	–	files wu 1
3_city_elves_writeups #command-injection #waf-bypass	b01lers 2024	30.80	files wu 1
msgme #command-injection #sandbox-escape	corCTF 2021	24.92	files wu 1
Ping_Me #command-injection #rce	TraceBash 2026	25.00	files wu 1
Spongebob #command-injection #php	PatriotCTF 2022	24.52	files wu 1
Scanner_Service #command-injection #nmap	SekaiCTF 2023	24.86	files wu 1
MoozChat #command-injection #jwt #weak-diffie-hellman #meet-in-the-middle (mitm)	PlaidCTF 2020	93.15	files wu 1
EzPHP #command-injection #ifs-bypass #filter-bypass	ISITDTU 2023 Quals	37.00	files wu 1
caas_renewed #command-injection #filter-bypass	niteCTF 2023	–	files wu 1
Flower_Shop #command-injection #curl #webhook	PatriotCTF 2023	24.52	files wu 1
omgsosmolhowhacc_2_electric_boogaloo #command-injection #argument-injection #newline-injection #curl	PBjar 2021	23.18	files wu 1
png-wizard #command-injection	HSCTF 2022	–	files wu 1
tesseract #command-injection	BuckeyeCTF 2021	24.81	files wu 1
heiko #command-injection	hxp 2020	94.00	files wu 1
cookie clicker #client-side-validation #local-storage	UTCTF 2024	–	files src wu 1
pogn #client-side-trust	LA 2024	–	files wu 1
SafeNotes_2.0 #client-side-path-traversal #cspt	1337UP 2024	–	files wu 1
b01lers_casino #client-side-hashing #sha256	b01lers 2024	30.80	files wu 1
Now_You_C_Me #client-side-desync	SEETF 2023	–	files wu 1
SuperSecure™ #client-side-auth #javascript	angstromCTF 2016	–	files src wu 1
co2v2 #class-pollution	DownUnderCTF 2024	68.04	files wu 1
UBI #chrome-n-day #xss	angstromCTF 2020	–	files wu 1
Ringtone #chrome-extension #dom-clobbering #xss	zer0pts 2023	52.62	files wu 1
Puppet #chrome-devtools-protocol #arbitrary-file-read	CircleCityCon 2021	25.00	files wu 1
forms #charset-encoding-differential #xss	ImaginaryCTF 2024	49.81	files wu 1
bobles_and_narnes #case-sensitivity #bun-sql #parser-differential	LA 2026	–	files wu 1
VerySafe #caddy-path-traversal #php-fpm #argument-injection	RCTF 2021	–	files wu 1
Cache_Cache #cache-poisoning #same-site-cookies	HeroCTF 2024	–	files wu 1
Potion_Seller #business-logic-flaw	SwampCTF 2024	40.40	files wu 1
fruit-store #business-logic-flaw	TJCTF 2022	–	files wu 1
Boom_Boom_Hell #bun-shell-injection	LINE 2024	–	files wu 1
readme2 #bun #host-header-injection	ImaginaryCTF 2024	49.81	files wu 1
pay-to-win #bruteforce	TJCTF 2023	–	files wu 1
do_not_touch_my_localhost #browser-extension #proxy-abuse #private-network-access-bypass #caddy	N1CTF 2022	77.68	files wu 1
ghost_note #browser-extension #ghostery	b01lers 2024	30.80	files wu 1
Are_you_incognito #browser-extension #dom-clobbering	TPCTF 2025	–	files wu 1
Drift_Chat #broken-access-control #missing-return #go	SAS 2025 Quals	20.72	files wu 1
Awkward_Bypass #blind-sql-injection	ImaginaryCTF 2021	–	files wu 1
MAAS #blind-command-injection #time-based	RaRCTF 2021	24.53	files wu 1
ant_universe #bcrypt-truncation #authentication-bypass	VuwCTF 2026	25.00	files wu 1