Web CTF challenges

2,454 Web CTF challenges from 308 CTFs (2011–2026), 449 with writeups.

Top web techniques

Challenges

Filter and sort these in the challenge browser →

Challenge	CTF	Weight	Has
codebox #web #xss #csp-bypass #trusted-types	DiceCTF 2023	36.70	files wu 2
uuid-hell #uuid-prediction	LA 2023	–	files wu 2
yana #subdomain-takeover #xs-leak	UIUCTF 2021	–	files wu 2
archived #stored-xss	hxp 2022	–	files wu 2
File_Sharing_Portal #ssti-via-filename	n00bzCTF 2024	24.23	files wu 2
Loginme #ssti #http-header-injection	SCTF 2021	–	files wu 2
diveinternal #ssrf-host-header	LINE 2021	–	files wu 2
ImageServicesViewer #ssrf #prototype-pollution #url-parsing-bypass	TetCTF 2023	53.89	files wu 2
Raas #ssrf	InCTF 2021	70.41	files wu 2
sqlite_web #sqlite-rce	hxp 2022	–	files wu 2
baby_sqli #sql-injection #sqlite #escape-bypass #authentication-bypass	zer0pts 2021	24.56	files wu 2
Yummy_Vegetables #sql-injection	MetaCTF 2021	–	files wu 2
diamond-safe #sql-injection	Hack.lu 2021	94.48	files wu 2
Wowza #race-condition #prototype-pollution #ssrf	PlaidCTF 2021	99.64	files wu 2
b_locked #race-condition #captcha-bypass	snakeCTF 2025 Quals	36.65	files wu 2
RobertIsAGangsta #python-type-confusion #json-scientific-notation #auth-bypass	CyberSecurityRumble 2022	62.00	files wu 2
Online_Python_Editor #python-sandbox-escape	TRX 2025	–	files wu 2
online_compiler #php-disable-functions-bypass #ffi	3kCTF 2021	24.14	files wu 2
Baby_explorer #php #path-traversal #patch-diffing	CyberSecurityRumble 2023 Quals	24.80	files wu 2
PharOut #phar-deserialization	Tenable 2021	22.37	files wu 2
secureuploader #path-traversal #os-path-join	RaRCTF 2021	24.53	files wu 2
gallery #path-traversal	HSCTF 2022	–	files wu 2
mmocc #path-traversal	TJCTF 2022	–	files wu 2
heres-my-password #password-spraying	JerseyCTF 2022	25.00	files wu 2
apache-logs #log-analysis	JerseyCTF 2022	25.00	files wu 2
roks #lfi-double-encoding	ImaginaryCTF 2023	34.52	files wu 2
404NotFound #jolokia-exploitation	BSidesTLV 2022	23.94	files wu 2
Huge_Primes #integer-factorization #yafu	Block 2021	30.75	files wu 2
MSN_Revive #idor #broken-access-control	Srdnlen 2026 Quals	34.76	files wu 2
Awesomenotes_I #htmx-injection	Hack.lu 2023	94.73	files wu 2
G0tchaberg #html-to-pdf-lfi	KalmarCTF 2025	33.89	files wu 2
very-secure #flask-session-forgery	HSCTF 2023	–	files wu 2
ExcellentDatabase #excel-formula-injection #csv-injection #libreoffice	PatriotCTF 2022	24.52	files wu 2
Notepad #dompurify-bypass	DownUnderCTF 2021	–	files wu 2
new_housing_portal #dom-xss	LA 2024	–	files wu 2
sanity #dom-clobbering #prototype-pollution #xss	AmateursCTF 2023	24.54	files wu 2
modernblog #dom-clobbering #css-leak	corCTF 2022	24.92	files wu 2
umassdining #dom-based-xss #csp-bypass #double-encoding	UMassCTF 2022	23.56	files wu 2
harmony_chat #deserialization	Dragon 2020	98.00	files wu 2
california-state-police #csp-bypass-navigation	LA 2023	–	files wu 2