CTF challenges & writeups

44 challenges in family ⊕ web:injection ✕ clear · browse all techniques

Challenge	CTF	Weight	Category	Has
Pixel_Perfect #arbitrary-file-upload #rce	TRX 2026	–	Web	files wu 1
Duck_Nettool_Revenge #filter-bypass #glob-expansion #command-injection	V1T 2026	22.14	Web	files wu 1
GitBad #git-submodule-hook-rce	L3akCTF 2025	24.43	Web	files wu 1
gpwaf #web #prompt-injection #ejs-ssti #rce	DiceCTF 2024 Quals	54.40	Web	files wu 1
Open_Seasame #stored-xss #command-injection #admin-bot	PatriotCTF 2024	31.83	Web	files wu 1
3_city_elves_writeups #command-injection #waf-bypass	b01lers 2024	30.80	Web	files wu 1
php_sucks #php-file-upload-bypass #strtok-filename-truncation #rce	BackdoorCTF 2023	–	Web	files wu 1
jwtjail #web #jwt #nodejs-vm-escape #sandbox-escape #toprimitive #rce	DiceCTF 2023	36.70	Web	files wu 1
Flower_Shop #command-injection #curl #webhook	PatriotCTF 2023	24.52	Web	files wu 1
0_CSP #crlf-injection #xss #cache-poisoning	Securinets 2023 Quals	65.42	Web	files wu 1
Scanner_Service #command-injection #nmap	SekaiCTF 2023	24.86	Web	files wu 1
raas-v1 #curl-argument-injection #local-file-read #ssrf	ASIS 2022 Finals	87.00	Web	files wu 1
png-wizard #command-injection	HSCTF 2022	–	Web	files wu 1
wayyang #python-eval-injection #filter-bypass	SEETF 2022	–	Pwn	files wu 3
LocalCardMaker #lfi (local-file-inclusion)#php-rce	THCon 2022	–	Web	files wu 1
SaaS #sed-command-injection	ImaginaryCTF 2021	–	Web	files wu 3
Custom_Blog #php-session-lfi-rce	MetaCTF 2021	–	Web	files wu 3
VerySafe #caddy-path-traversal #php-fpm #argument-injection	RCTF 2021	–	Web	files wu 1
webserver #command-injection	UMassCTF 2021	23.56	Pwn	files wu 3
Static_Site #crlf-injection #nginx-misconfiguration	VolgaCTF 2021 Quals	32.73	Web	files wu 2
msgme #command-injection #sandbox-escape	corCTF 2021	24.92	Web	files wu 1
ContrivedWebProblem #ssrf #ftp-crlf-injection #rabbitmq #nodemailer-attachment	PlaidCTF 2020	93.15	Web	files wu 3
MoozChat #command-injection #jwt #weak-diffie-hellman #meet-in-the-middle (mitm)	PlaidCTF 2020	93.15	Web	files wu 1
heiko #command-injection	hxp 2020	94.00	Web	files wu 1
babyphp #php-code-injection	Hack.lu 2018	72.75	Misc	files wu 1
Ping_Me #command-injection #rce	TraceBash 2026	25.00	Web	files wu 1
Proxy #ssrf #caddy-admin-api #log-injection #rce	SAS 2025 Quals	20.72	Web	files wu 1
runway0 #command-injection	BuckeyeCTF 2024	50.91	Pwn	files wu 1
Cybercrime_Society_Club_Germany #argument-injection #auth-bypass	CCCamp 2023	25.00	Web	files wu 1
sequence_gallery #argument-injection #dc-rce	CrewCTF 2023	20.33	Web	files wu 1
Borraccia #path-traversal #rce	TeamItaly 2023	24.88	Web	files wu 1
jabasass #wildfly-undertow-temp-file-upload #war-deploy-rce #java	0CTF 2022	100.00	Web	files wu 1
2linenodejs #prototype-pollution #nodejs #rce-gadget	Balsn 2022	53.42	Web	files wu 1
Intellimage #hash-length-extension #exiftool-rce	BSidesTLV 2021	23.94	Web	files wu 1
Paired #windows-reversing #ipc-postmessage #inter-process-code-injection #xor	CyBRICS 2021	33.32	Reverse	files wu 1
ProgrammersHateProgramming_2 #php-filter-bypass #nested-keyword-bypass #php-code-injection	PBjar 2021	23.18	Web	files wu 1
omgsosmolhowhacc_2_electric_boogaloo #command-injection #argument-injection #newline-injection #curl	PBjar 2021	23.18	Web	files wu 1
c_mon_see_my_vulns #php-eval-injection #disable-functions-bypass #chankro #ld-preload	Pwn2Win 2021	83.41	Pwn	files wu 2
illusion #prototype-pollution #rce	Pwn2Win 2021	83.41	Web	files wu 3
lemonthinker #command-injection	RaRCTF 2021	24.53	Web	files wu 3

Challenges