$ ctf42

Challenges

Category
Difficulty
CTFtime weight
–
Higher weight ≈ harder, more prestigious event.
Year
–
Must have
Reset

355 challenges in family ⊕ web ✕ clear · browse all techniques

Challenge CTF Weight Category Has
SPAM
#authentication-bypass#password-reset
 snakeCTF 2025 Quals 36.65 Web files wu 1
b_locked
#race-condition#captcha-bypass
 snakeCTF 2025 Quals 36.65 Web files wu 2
BioCorp
#header-ip-spoofing#access-control-bypass#xxe
 1337UP 2024 – Web files wu 1
Cat_Club
#jwt-algorithm-confusion#ssti#pug
 1337UP 2024 – Web files wu 1
SafeNotes_2.0
#client-side-path-traversal#cspt
 1337UP 2024 – Web files wu 1
NoSQL
#nosql-injection
 BCACTF 2024 – Web files wu 1
calculator
#web#xss#eval#typescript#no-csp
 DiceCTF 2024 Quals 54.40 Web files wu 1
funnylogin
#web#sql-injection#prototype-pollution#type-confusion
 DiceCTF 2024 Quals 54.40 Web files wu 3
gpwaf
#web#prompt-injection#ejs-ssti#rce
 DiceCTF 2024 Quals 54.40 Web files wu 1
co2v2
#class-pollution
 DownUnderCTF 2024 68.04 Web files wu 1
Bench_Press
#css-injection
 Hack.lu 2024 100.00 Web files wu 1
Secret_Notes
#cookie-tossing
 IRON 2024 – Web files wu 1
readme
#nginx-path-normalization
 ImaginaryCTF 2024 49.81 Web files wu 1
runner_net
#user-agent-spoofing
 JerseyCTF 2024 21.26 Web files wu 1
ctf_wiki
#csp-img-exfiltration
 LA 2024 – Web files wu 1
la_housing_portal
#sql-injection
 LA 2024 – Web files wu 3
new_housing_portal
#dom-xss
 LA 2024 – Web files wu 2
pogn
#client-side-trust
 LA 2024 – Web files wu 1
Boom_Boom_Hell
#bun-shell-injection
 LINE 2024 – Web files wu 1
Heritage
#http-request-splitting
 LINE 2024 – Web files wu 1
auth_internal
#ssrf-file-scheme
 LINE 2024 – Web files wu 1
graphql_101
#graphql-batching-bypass
 LINE 2024 – Web files wu 1
hhhhhhhref
#open-redirect
 LINE 2024 – Web files wu 1
jalyboy_baby
#jwt-none-algorithm
 LINE 2024 – Web files wu 1
jalyboy_jalygirl
#cve-2022-21449
 LINE 2024 – Web files wu 1
one_time_read
#dom-xss
 LINE 2024 – Web files wu 1
Advanced_JSON_Cutifier
#jsonnet-file-read
 Mapna 2024 24.59 Web files wu 1
Novel_reader
#double-url-encode-path-traversal
 Mapna 2024 24.59 Web files wu 1
Hacker_Web_Store
#sql-injection
 NahamCon 2024 41.61 Web files wu 1
Open_Seasame
#stored-xss#command-injection#admin-bot
 PatriotCTF 2024 31.83 Web files wu 1
Funny_lfr
#lfi (local-file-inclusion)#race-condition
 SekaiCTF 2024 36.96 Web files wu 1
Tagless
#xss#csp-bypass#mime-sniffing
 SekaiCTF 2024 36.96 Web files wu 1
htmlsandbox
#xss#csp-bypass#charset-confusion
 SekaiCTF 2024 36.96 Web files wu 1
Potion_Seller
#business-logic-flaw
 SwampCTF 2024 40.40 Web files wu 1
SpaceNotes
#access-control-bypass
 THCon 2024 – Web files wu 1
SQLite_of_Hand
#sql-injection
 TSG 2024 – Pwn files wu 1
Log_Action
#ssrf#cve-2024-34351
 UIUCTF 2024 – Web files wu 3
pwnypass
#css-injection#browser-extension
 UIUCTF 2024 – Web files wu 1
Crabby_Clicker
#http-pipelining#race-condition
 UMassCTF 2024 43.10 Web files wu 1
3_city_elves_writeups
#command-injection#waf-bypass
 b01lers 2024 30.80 Web files wu 1