CTF challenges & writeups

32 challenges in family ⊕ web:framework-specific ✕ clear · browse all techniques

Challenge	CTF	Weight	Category	Has
cookie_recipes_v3 #web #type-confusion #parameter-pollution #express	DiceCTF 2025 Quals	81.00	Web	files wu 1
Layers_of_Lies #php-wrappers	JerseyCTF 2025	24.73	Web	files wu 1
certay_revenge #php-eval-filter-bypass	L3akCTF 2025	24.43	Web	files wu 1
airspeed #airspeed-ssti #velocity-template #nginx-path-normalization-bypass	QnQSec 2025	24.76	Web	files wu 1
Art_Contest #file-upload #php-filter-bypass #suid	WolvCTF 2025	47.25	Web	files wu 1
readme #nginx-path-normalization	ImaginaryCTF 2024	49.81	Web	files wu 1
graphql_101 #graphql-batching-bypass	LINE 2024	–	Web	files wu 1
funny_factorials #lfi (local-file-inclusion)#path-normalization-bypass #flask	AmateursCTF 2023	24.54	Web	files wu 3
php_sucks #php-file-upload-bypass #strtok-filename-truncation #rce	BackdoorCTF 2023	–	Web	files wu 1
jwtjail #web #jwt #nodejs-vm-escape #sandbox-escape #toprimitive #rce	DiceCTF 2023	36.70	Web	files wu 1
force #graphql-batching-attack #rate-limit-bypass	corCTF 2023	36.97	Web	files wu 3
knock-knock #web #hmac-forgery #predictable-secret #nodejs	DiceCTF 2022	24.82	Web	files wu 3
vm-calc #web #prototype-pollution #nodejs-vm #proxy	DiceCTF 2022	24.82	Web	files wu 1
Gatekeeping #web #nginx-gunicorn-path-bypass #access-control-bypass	CSAW 2021 Quals	20.54	Web	files wu 3
WebUtils #web #xss #nodejs #cookie-theft	DiceCTF 2021	24.82	Web	files wu 3
build-a-panel #web #sql-injection #nodejs #admin-bot	DiceCTF 2021	24.82	Web	files wu 3
CerealAndMilk #php-object-injection	NahamCon 2021	24.98	Web	files wu 3
VerySafe #caddy-path-traversal #php-fpm #argument-injection	RCTF 2021	–	Web	files wu 1
Seventh_Core_of_Hell #core-dump-analysis #flask	TAMUctf 2021	–	Web	files wu 1
Static_Site #crlf-injection #nginx-misconfiguration	VolgaCTF 2021 Quals	32.73	Web	files wu 2
kantan_calc #nodejs #vm-escape #sandbox-escape	zer0pts 2021	24.56	Web	files wu 3
ProfileEditor #path-traversal #flask	PwnMe 2025 Quals	24.95	Web	files wu 1
Conspiracy_Social #web #xss #websocket #admin-bot-token-theft #csp-bypass	CyberSecurityRumble 2024 Quals	100.00	Web	files wu 1
SaaS #nginx-server-name-bypass #json-schema-ajv-exploitation	Balsn 2023	79.09	Web	files wu 1
InternSkripting #web #http-header-manipulation #nginx-misconfiguration #unicode-int-bypass	CyberSecurityRumble 2023 Quals	24.80	Web	files wu 1
SecureHashedDb #sql-injection #php-object-injection #eval	DanteCTF 2023	24.44	Web	files wu 1
mod_pwn #stack-overflow #apache-module	BSidesTLV 2022	23.94	Pwn	files wu 1
2linenodejs #prototype-pollution #nodejs #rce-gadget	Balsn 2022	53.42	Web	files wu 1
my_first_app #nextjs-source-api-disclosure	Balsn 2022	53.42	Web	files wu 1
online_compiler #php-disable-functions-bypass #ffi	3kCTF 2021	24.14	Web	files wu 2
ProgrammersHateProgramming_2 #php-filter-bypass #nested-keyword-bypass #php-code-injection	PBjar 2021	23.18	Web	files wu 1
BLT #cve-2021-41773 #path-traversal #apache	SPbCTF 2021 Quals	–	Misc	files wu 1

Challenges