CTF challenges & writeups

46 challenges in family ⊕ web:auth ✕ clear · browse all techniques

Challenge	CTF	Weight	Category	Has
Blinky #pointer-authentication #speculative-execution #cache-side-channel #mips	R3CTF 2026	35.95	Misc	files wu 1
MSN_Revive #idor #broken-access-control	Srdnlen 2026 Quals	34.76	Web	files wu 2
ant_universe #bcrypt-truncation #authentication-bypass	VuwCTF 2026	25.00	Web	files wu 1
Escatlate_flag_1 #mass-assignment #insecure-role-assignment #broken-access-control	1753CTF 2025	34.82	Web	files wu 1
Knight_Connect #login-link-forgery	KnightCTF 2025	18.78	Web	files wu 1
Puzzle #idor #privilege-escalation #info-disclosure	Securinets CTF 2025 Quals	–	Web	files wu 1
Rush_Hour #xss #cookie-theft #cors-bypass	UMassCTF 2025	48.38	Web	files wu 1
Rush_Hour_v2 #xss #cookie-theft	UMassCTF 2025	48.38	Web	files wu 1
SPAM #authentication-bypass #password-reset	snakeCTF 2025 Quals	36.65	Web	files wu 1
BioCorp #header-ip-spoofing #access-control-bypass #xxe	1337UP 2024	–	Web	files wu 1
Cat_Club #jwt-algorithm-confusion #ssti #pug	1337UP 2024	–	Web	files wu 1
Secret_Notes #cookie-tossing	IRON 2024	–	Web	files wu 1
jalyboy_baby #jwt-none-algorithm	LINE 2024	–	Web	files wu 1
SpaceNotes #access-control-bypass	THCon 2024	–	Web	files wu 1
imagehost #jwt-kid-path-traversal #rs256-key-confusion #auth-bypass	b01lers 2024	30.80	Web	files wu 1
Dark_BrOTTERhood #move-access-control	justCTF 2024 Quals	77.17	Blockchain	files wu 3
jnotes #web #cookie-injection #java-cookie-parsing #iframe-leak	DiceCTF 2023	36.70	Web	files wu 1
jwtjail #web #jwt #nodejs-vm-escape #sandbox-escape #toprimitive #rce	DiceCTF 2023	36.70	Web	files wu 1
very-secure #flask-session-forgery	HSCTF 2023	–	Web	files wu 2
Chunky #request-smuggling #jwt #jwks-spoofing #cache-poisoning	SekaiCTF 2023	24.86	Web	files wu 1
zombie-101 #xss #cookie-theft	WolvCTF 2023	24.33	Web	files wu 3
cakegear #php-type-juggling #auth-bypass	CakeCTF 2022	–	Web	files wu 1
Gatekeeping #web #nginx-gunicorn-path-bypass #access-control-bypass	CSAW 2021 Quals	20.54	Web	files wu 3
BabierCSP #web #csp-bypass #xss #cookie-theft	DiceCTF 2021	24.82	Web	files wu 3
WebIDE #web #js-sandbox-escape #service-workers #cookie-path-bypass	DiceCTF 2021	24.82	Web	files wu 3
WebUtils #web #xss #nodejs #cookie-theft	DiceCTF 2021	24.82	Web	files wu 3
grading #idor	HSCTF 2021	–	Web	files wu 3
message-board #cookie-tampering	HSCTF 2021	–	Web	files wu 3
Easyphp #url-decode-discrepancy #auth-bypass #double-encoding	RCTF 2021	–	Web	files wu 1
junior-jwt #jwt #algorithm-confusion #rs256-to-hs256	S4CTF 2021	24.52	Web	files wu 1
flask-admin #broken-access-control #path-normalization	VolgaCTF 2021 Quals	32.73	Web	files wu 2
findme #mqtt-authorization-bypass	corCTF 2021	24.92	Web	files wu 1
mathme #cookie-injection #mathjax-xss	corCTF 2021	24.92	Web	files wu 1
baby_sqli #sql-injection #sqlite #escape-bypass #authentication-bypass	zer0pts 2021	24.56	Web	files wu 2
MoozChat #command-injection #jwt #weak-diffie-hellman #meet-in-the-middle (mitm)	PlaidCTF 2020	93.15	Web	files wu 1
Bubble_Tea_Diaries #stored-xss #bbcode-parser #html-escape-bypass #jwt	SAS 2025 Quals	20.72	Web	files wu 1
Drift_Chat #broken-access-control #missing-return #go	SAS 2025 Quals	20.72	Web	files wu 1
learn_HTTP #xss #admin-bot #jwt-secret-cracking	Pearl 2024	23.95	Web	files wu 1
Banking_Issues #python-negative-index #access-control-bypass	BxMCTF 2023	–	Pwn	files wu 1
Cybercrime_Society_Club_Germany #argument-injection #auth-bypass	CCCamp 2023	25.00	Web	files wu 1

Challenges