Web - Server

Discover the mechanisms, protocols and technologies used on the Internet and learn to abuse them!

These challenges are designed to train users on HTML, HTTP and other server side mechanisms. The following series of challenges will cultivate a better understanding of techniques such as : Basic workings of multiple authentication mechanisms, handling form data, inner workings of web applications, etc. ...

Prerequisites:
– Understand HTML.
– Understand the HTTP protocol.
– Ability to manipulate a web browser.

96 Challenges

Results	Name	Validations	Number of points	Difficulty	Author	Note ↓↑	Solution	Date
	JWT - Revoked token	2% 6028	25		ArnC		6	20 March 2020
	PHP - Remote Xdebug	1% 1493	25		mayfly		4	18 March 2020
	Nginx - SSRF Misconfiguration	1% 64	30		.Yo0x		0	27 September 2024
	SQL injection - Authentication - GBK	3% 9761	30		dvor4x		4	2 December 2015
	CRLF	10% 31630	20		g0uZ		7	31 July 2011
	Java - Spring Boot	1% 2337	40		dvor4x		3	24 December 2016
	NodeJS - Prototype Pollution Bypass	1% 534	45		Worty		1	22 October 2021
	GraphQL - Introspection	2% 3649	20		apges01		4	19 January 2023
	JWT - Public key	2% 3839	30		Jrmbt		5	21 August 2019
	Flask - Development server	1% 925	30		Sanlokii		1	29 November 2023
	PHP - Path Truncation	2% 5445	35		Geluchat		6	25 March 2015
	SQL Injection - Second Order	1% 211	55		k4ndar3c		1	29 November 2023
	API - Broken Access 2	1% 434	40		Nishacid , Mika		1	18 January 2024
	Weak password	32% 109251	10		g0uZ		7	3 October 2006
	PHP - Apache configuration	1% 2379	25		erk3 , nemoz		4	8 July 2022
	Backup file	16% 53911	15		g0uZ		10	27 February 2011
	HTTP - User-agent	24% 83318	10		g0uZ		10	3 October 2006
	Nginx - Root Location Misconfiguration	1% 169	15		.Yo0x		0	27 September 2024
	Command injection - Filter bypass	3% 7618	30		sambecks		6	20 September 2017
	SQL injection - Filter bypass	1% 2888	80		sambecks		7	21 July 2014
	GraphQL - Backend injection	1% 434	40		apges01		1	19 January 2023
	Install files	13% 43445	15		g0uZ		6	7 October 2006
	API - Broken Access	2% 4221	15		Nishacid , Mika		3	18 January 2024
	File upload - Polyglot	1% 455	45		Cyxo		1	8 July 2022
	Server Side Request Forgery	1% 1900	50		sambecks		7	22 June 2018
	XSLT - Code execution	2% 3720	30		ghozt		5	16 July 2017
	HTTP - Open redirect	19% 66257	10		Swissky		10	2 August 2017
	Python - dotenv	1% 25	70		jrjgjk		0	27 September 2024
	HTTP - Headers	16% 54239	15		Arod		9	11 January 2015
	SQL Injection - Routed	2% 5402	35		soka		5	24 December 2016
	Elixir - EEx	1% 267	35		lolo42		1	29 November 2023
	JWT - Unsecure Key Handling	1% 765	35		Nishacid , Mika		5	23 February 2023
	PHP - register globals	5% 15804	25		g0uZ		2	8 October 2011
	JWT - Unsecure File Signature	1% 2157	25		Nishacid , Mika		3	23 February 2023
	SQL injection - Insert	1% 3184	40		sambecks		4	23 February 2015
	SQL injection - File reading	2% 6020	40		Arod		3	19 October 2014
	SQL injection - Time based	2% 5797	45		ycam		4	11 September 2015
	File upload - Null byte	7% 23786	25		g0uZ		4	26 December 2012
	SQL Truncation	2% 6761	35		Geluchat		2	1 May 2015
	HTTP - IP restriction bypass	9% 28616	10		Cyrhades		7	23 March 2021
	Nginx - Alias Misconfiguration	1% 1844	15		.Yo0x		2	27 September 2024
	PHP - Eval	2% 3623	40		chmod		10	8 November 2018
	PHP - assert()	5% 15406	25		Birdy42		10	26 November 2016
	GraphQL - Injection	1% 761	30		apges01		2	19 January 2023
	PHP - Serialization	2% 6735	35		Arod		3	3 February 2014
	XML External Entity	2% 5638	35		sambecks		2	20 October 2014
	Node - Serialize	1% 1276	35		Mhd_Root		2	24 February 2021
	PHP - Eval - Advanced filters bypass	1% 597	40		Podalirius		2	8 July 2022
	GraphQL - Mutation	1% 1573	40		CanardMandarin		2	20 October 2020
	HTTP - Directory indexing	22% 76865	15		g0uZ		7	7 October 2006
	PHP - type juggling	3% 8849	30		vic		4	10 March 2016
	LDAP injection - Blind	1% 3462	55		g0uZ		2	8 June 2013
	HTTP - Improper redirect	13% 42261	15		Arod		10	26 November 2014
	Local File Inclusion - Double encoding	4% 12821	30		zM_		4	13 June 2016
	SQL injection - Error	3% 7847	40		sambecks		5	4 March 2015
	NoSQL injection - Authentication	3% 7677	35		mastho		8	31 May 2015
	HTTP - Cookies	13% 45375	20		g0uZ		8	7 October 2006
	Local File Inclusion - Wrappers	2% 3637	40		sambecks		4	2 March 2016
	HTTP - POST	14% 49097	15		Th1b4ud		10	14 August 2018
	PHP - Unserialize overflow	1% 778	55		mayfly		2	4 April 2020
	Directory traversal	10% 35082	25		g0uZ		3	31 July 2011
	Remote File Inclusion	4% 11769	30		g0uZ		8	25 November 2015
	SQL injection - Blind	3% 7671	50		g0uZ		6	27 February 2011
	HTML - Source code	49% 168564	5		g0uZ		5	3 October 2006
	XSS - Server Side	1% 2640	20		Elf		4	23 June 2023
	File upload - Double extensions	10% 34739	20		g0uZ		10	24 December 2012
	SQL injection - Authentication	14% 45701	30		g0uZ		11	27 February 2011
	Local File Inclusion	8% 25477	30		g0uZ		4	2 October 2011
	PHP - Command injection	19% 65903	10		sambecks		10	20 September 2017
	JWT - Weak secret	4% 11888	25		Jrmbt		6	21 August 2019
	LDAP injection - Authentication	3% 10358	35		g0uZ		8	26 May 2013
	XPath injection - Blind	1% 2342	75		g0uZ		5	27 December 2012
	PHP - preg_replace()	3% 9052	30		sambecks		4	2 March 2016
	Insecure Code Management	4% 13669	20		Swissky		6	29 September 2019
	File upload - ZIP	3% 9552	30		ghozt		3	3 August 2017
	HTTP - Verb tampering	14% 46004	15		g0uZ		10	3 February 2011
	API - Mass Assignment	1% 2695	20		Nishacid , Mika		2	18 January 2024
	SQL injection - String	7% 21815	30		g0uZ		10	24 December 2012
	Python - Blind SSTI Filters Bypass	1% 660	75		Podalirius		5	7 September 2021
	JWT - Header Injection	1% 1172	30		Nishacid , Mika		2	23 February 2023
	File upload - MIME type	8% 27853	20		g0uZ		10	26 December 2012
	XPath injection - Authentication	2% 6601	35		g0uZ		6	27 December 2012
	XPath injection - String	2% 3924	40		g0uZ		5	26 May 2013
	SQL injection - Numeric	5% 15052	35		g0uZ		7	24 December 2012
	PHP - Filters	6% 19622	25		g0uZ		3	27 February 2011
	PHP - Loose Comparison	3% 7265	30		ghozt		4	10 January 2018
	JWT - Introduction	5% 17146	20		Kn0wledge		5	21 August 2019
	PHP - Unserialize Pop Chain	1% 687	55		Worty		2	22 October 2021
	Java - Server-side Template Injection	4% 10608	30		righettod		6	29 November 2015
	Python - Server-side Template Injection Introduction	2% 4490	25		Podalirius		7	7 September 2021
	NoSQL injection - Blind	1% 3021	45		ghozt		6	26 November 2016
	NodeJS - vm escape	1% 743	50		Podalirius		1	15 April 2021
	Node - Eval	1% 2933	30		Mhd_Root		7	24 February 2021
	Yaml - Deserialization	1% 1399	35		Nishacid		2	20 April 2021
	Java - Custom gadget deserialization	1% 172	50		Elweth		0	28 December 2023
	Flask - Unsecure session	1% 2515	20		Sanlokii		1	29 November 2023

Challenge Results

Pseudo	Challenge	Lang	Date
Jesiontrop	XPath injection - Authentication		21 January 2025 at 16:10
wormchester	JWT - Introduction		21 January 2025 at 16:08
kappacite	CRLF		21 January 2025 at 16:00
Jesiontrop	XML External Entity		21 January 2025 at 15:59
Vinz	HTTP - Headers		21 January 2025 at 15:58
Gokulraj	Insecure Code Management		21 January 2025 at 15:56
ryzwannj	PHP - Register globals		21 January 2025 at 15:53
Jonas	HTTP - User-agent		21 January 2025 at 15:52
ryzwannj	PHP - Filters		21 January 2025 at 15:52
nf.esteves89	HTML - Code source		21 January 2025 at 15:52