$ ctf42

Challenges

Category
Difficulty
CTFtime weight
–
Higher weight ≈ harder, more prestigious event.
Year
–
Must have
Reset

2434 challenges · browse all techniques

Challenge CTF Weight Category Has
Rush_Hour
#xss#cookie-theft#cors-bypass
 UMassCTF 2025 48.38 Web files wu 1
Rush_Hour_v2
#xss#cookie-theft
 UMassCTF 2025 48.38 Web files wu 1
Art_Contest
#file-upload#php-filter-bypass#suid
 WolvCTF 2025 47.25 Web files wu 1
Javascript_Puzzle
#javascript-type-coercion#error-based-leak
 WolvCTF 2025 47.25 Web files wu 1
Limited_1
#sql-injection#union-based#filter-bypass
 WolvCTF 2025 47.25 Web files wu 1
Positive_Players
#prototype-pollution
 justCTF 2025 97.20 Web files wu 1
ExploitMe
#mass-assignment
 snakeCTF 2025 Quals 36.65 Web files wu 1
SPAM
#authentication-bypass#password-reset
 snakeCTF 2025 Quals 36.65 Web files wu 1
b_locked
#race-condition#captcha-bypass
 snakeCTF 2025 Quals 36.65 Web files wu 2
BioCorp
#header-ip-spoofing#access-control-bypass#xxe
 1337UP 2024 – Web files wu 1
Cat_Club
#jwt-algorithm-confusion#ssti#pug
 1337UP 2024 – Web files wu 1
SafeNotes_2.0
#client-side-path-traversal#cspt
 1337UP 2024 – Web files wu 1
NoSQL
#nosql-injection
 BCACTF 2024 – Web files wu 1
calculator
#web#xss#eval#typescript#no-csp
 DiceCTF 2024 Quals 54.40 Web files wu 1
funnylogin
#web#sql-injection#prototype-pollution#type-confusion
 DiceCTF 2024 Quals 54.40 Web files wu 3
gpwaf
#web#prompt-injection#ejs-ssti#rce
 DiceCTF 2024 Quals 54.40 Web files wu 1
Prisoner_Processor
#prototype-pollution
 DownUnderCTF 2024 68.04 Web files wu 1
co2v2
#class-pollution
 DownUnderCTF 2024 68.04 Web files wu 1
Bench_Press
#css-injection
 Hack.lu 2024 100.00 Web files wu 1
Secret_Notes
#cookie-tossing
 IRON 2024 – Web files wu 1
readme
#nginx-path-normalization
 ImaginaryCTF 2024 49.81 Web files wu 1
runner_net
#user-agent-spoofing
 JerseyCTF 2024 21.26 Web files wu 1
ctf_wiki
#csp-img-exfiltration
 LA 2024 – Web files wu 1
la_housing_portal
#sql-injection
 LA 2024 – Web files wu 3
new_housing_portal
#dom-xss
 LA 2024 – Web files wu 2
pogn
#client-side-trust
 LA 2024 – Web files wu 1
Boom_Boom_Hell
#bun-shell-injection
 LINE 2024 – Web files wu 1
G0tcha_G0tcha_doggy
#securerandom-prediction
 LINE 2024 – Web files wu 1
Heritage
#http-request-splitting
 LINE 2024 – Web files wu 1
This_message_will_self_destruct_in...
#race-condition
 LINE 2024 – Web files wu 1
auth_internal
#ssrf-file-scheme
 LINE 2024 – Web files wu 1
graphql_101
#graphql-batching-bypass
 LINE 2024 – Web files wu 1
hhhhhhhref
#open-redirect
 LINE 2024 – Web files wu 1
jalyboy_baby
#jwt-none-algorithm
 LINE 2024 – Web files wu 1
jalyboy_jalygirl
#cve-2022-21449
 LINE 2024 – Web files wu 1
one_time_read
#dom-xss
 LINE 2024 – Web files wu 1
zipviewer_version_citizen
#zip-symlink-read
 LINE 2024 – Web files wu 1
zipviewer_version_clown
#zip-symlink-race
 LINE 2024 – Web files wu 1
Advanced_JSON_Cutifier
#jsonnet-file-read
 Mapna 2024 24.59 Web files wu 1
Novel_reader
#double-url-encode-path-traversal
 Mapna 2024 24.59 Web files wu 1