$ ctf42

Web CTF challenges

2,461 Web CTF challenges from 309 CTFs (2011–2026), 673 with writeups.

Top web techniques

#xss 70 #sql-injection 41 #ssti 30 #ssrf 26 #prototype-pollution 25 #path-traversal 25 #csp-bypass 23 #command-injection 21 #web 21 #filter-bypass 14 #xs-leak 14 #lfi 12 #rce 12 #race-condition 12 #css-injection 11

Challenges

Filter and sort these in the challenge browser →

Challenge CTF Weight Has
SecretPickle GPN 2026 – files
Secure_Gate tkbctf 2026 25.00 files
Secure_Notes BKISC 2026 – files
Secure_Secretpickle GPN 2026 – files
SeeTeeEffedIn GreyCatTheFlag 2026 Quals – files
Shaka FromDuskTillDawn 2026 Quals 20.14 files
Shift_Left_Brain_Right KubSTU 2026 24.83 files
Short_Notes TRX 2026 – files
Side_Channel_Surfer L3akCTF 2026 34.47 files
Simple_food_notifications GPN 2026 – files
SkyPort_Ops 0xFUN 2026 17.74 files
Solar_Eclipse upCTF 2026 24.42 files
SpotiVibe_1 Kind4SUS 2026 – files
SpotiVibe_2 Kind4SUS 2026 – files
Stellar_Scope Universal 2026 25.00 files
StifflingFluffiness TRX 2026 – files
Stillwell Estates HI Cyber Con CTF 2026 –
Technical_Debt BrunnerCTF 2026 24.66 files
Template_Playground CPCTF 2026 – files
Thank_you_JavaScript plfanzen 2026 25.00 files
The Coffee Shop HI Cyber Con CTF 2026 –
The_Style_of_Deception_Static THEMCTF 2026 – files
Time_to_Pretend UTCTF 2026 – files
Tiny_SQL BKCTF 2026 – files
Tiny_SQL_2 BKCTF 2026 – files
Tiny_Web GPN 2026 – files
TodoList Srdnlen 2026 Quals 34.76 files
Trusted_Rules TraceBash 2026 25.00 files
Trusted_Upstream BKISC 2026 – files
Ultimative_PHP FortID 2026 45.00 files
Unauthentische_Rache plfanzen 2026 25.00 files
Undercover_Pirate UMassCTF 2026 65.95 files
Undervattensgalleriet Undutmaning 2026 33.00 files
Unrealistic_Client_Side_Challenge_Flag_1 UofTCTF 2026 33.49 files
Unrealistic_Client_Side_Challenge_Flag_2 UofTCTF 2026 33.49 files
Vault TAMUctf 2026 – files
Vibechat Bhackari 2026 – files
Vulnerability_Research UofTCTF 2026 33.49 files
Wake_Up_Call Bhackari 2026 – files
WayWayback_Machine BKCTF 2026 – files