$ ctf42

Web CTF challenges

2,461 Web CTF challenges from 309 CTFs (2011–2026), 673 with writeups.

Top web techniques

#xss 70 #sql-injection 41 #ssti 30 #ssrf 26 #prototype-pollution 25 #path-traversal 25 #csp-bypass 23 #command-injection 21 #web 21 #filter-bypass 14 #xs-leak 14 #lfi 12 #rce 12 #race-condition 12 #css-injection 11

Challenges

Filter and sort these in the challenge browser →

Challenge CTF Weight Has
Waybird_Machine DEFCON 2026 Quals 63.22 files
Web_2_Doc_1 nullconHackIM 2026 Goa – files
Web_Design plfanzen 2026 25.00 files
Whisper HI Cyber Con CTF 2026 –
Who_Is_He TRX 2026 – files
XOD_Revenge SAS 2026 Quals 31.00 files
XSSaaS MntcrlCTF 2026 25.00 files
Yet_Another_SSTI MntcrlCTF 2026 25.00 files
Z CPCTF 2026 – files
ZazaStore PascalCTF 2026 24.00 files
Zebda L3akCTF 2026 34.47 files
ad_note_revenge LA 2026 – files
alienation CodeVinci 2026 18.57 files
are_xsleaks_dead TRX 2026 – files
attestation Cryovault 2026 Quals 25.00 files
average_contrived_notes_app RITSEC 2026 – files
bad_apple TAMUctf 2026 – files
bawker BlueHens 2026 44.77 files
biba_and_boba MIPT 2026 Quals 24.58 files
biscuit GaslightCTF 2026 – files
bloatware.js NNS 2026 – files
bugtracker THEMCTF 2026 – files
cant_count_no_more RITSEC 2026 – files
catvault_part_1 L3akCTF 2026 34.47 files
catvault_part_2 L3akCTF 2026 34.47 files
chained TJCTF 2026 – files
choppediver_oa UMDCTF 2026 – files
converter.js MntcrlCTF 2026 25.00 files
cookoff GPN 2026 – files
ctf_review pingCTF 2026 46.20 files
customainer KalmarCTF 2026 49.97 files
demolition UNbreakableInternational 2026 – files
diceminer DiceCTF 2026 Quals 100.00 files
dicewallet DiceCTF 2026 Quals 100.00 files
egg b01lers 2026 66.00 files
extend_note LA 2026 – files
far BreakTheSyntax 2026 56.25 files
fetcherx MntcrlCTF 2026 25.00 files
free_cloud_storage TJCTF 2026 – files
free_xss pingCTF 2026 46.20 files