Web - Server

Discover the mechanisms, protocols and technologies used on the Internet and learn to abuse them!

These challenges are designed to train users on HTML, HTTP and other server side mechanisms. The following series of challenges will cultivate a better understanding of techniques such as : Basic workings of multiple authentication mechanisms, handling form data, inner workings of web applications, etc. ...

Prerequisites:
– Understand HTML.
– Understand the HTTP protocol.
– Ability to manipulate a web browser.

96 Challenges

Results	Name	Validations	Number of points ↓↑	Difficulty	Author	Note	Solution	Date
	HTML - Source code	49% 168488	5		g0uZ		5	3 October 2006
	Weak password	32% 109194	10		g0uZ		7	3 October 2006
	PHP - Command injection	19% 65872	10		sambecks		10	20 September 2017
	HTTP - IP restriction bypass	9% 28579	10		Cyrhades		7	23 March 2021
	HTTP - User-agent	24% 83267	10		g0uZ		10	3 October 2006
	HTTP - Open redirect	19% 66225	10		Swissky		10	2 August 2017
	API - Broken Access	2% 4203	15		Nishacid , Mika		3	18 January 2024
	Backup file	16% 53891	15		g0uZ		10	27 February 2011
	HTTP - Directory indexing	22% 76840	15		g0uZ		7	7 October 2006
	HTTP - Headers	16% 54212	15		Arod		9	11 January 2015
	HTTP - POST	14% 49063	15		Th1b4ud		10	14 August 2018
	HTTP - Improper redirect	13% 42241	15		Arod		10	26 November 2014
	HTTP - Verb tampering	14% 45984	15		g0uZ		10	3 February 2011
	Install files	13% 43428	15		g0uZ		6	7 October 2006
	Nginx - Alias Misconfiguration	1% 1824	15		.Yo0x		2	27 September 2024
	Nginx - Root Location Misconfiguration	1% 168	15		.Yo0x		0	27 September 2024
	GraphQL - Introspection	2% 3646	20		apges01		4	19 January 2023
	XSS - Server Side	1% 2634	20		Elf		4	23 June 2023
	Insecure Code Management	4% 13659	20		Swissky		6	29 September 2019
	JWT - Introduction	5% 17132	20		Kn0wledge		5	21 August 2019
	Flask - Unsecure session	1% 2508	20		Sanlokii		1	29 November 2023
	API - Mass Assignment	1% 2685	20		Nishacid , Mika		2	18 January 2024
	File upload - MIME type	8% 27844	20		g0uZ		10	26 December 2012
	HTTP - Cookies	13% 45356	20		g0uZ		8	7 October 2006
	CRLF	10% 31615	20		g0uZ		7	31 July 2011
	File upload - Double extensions	10% 34728	20		g0uZ		10	24 December 2012
	PHP - assert()	5% 15401	25		Birdy42		10	26 November 2016
	Python - Server-side Template Injection Introduction	2% 4486	25		Podalirius		7	7 September 2021
	PHP - Remote Xdebug	1% 1491	25		mayfly		4	18 March 2020
	PHP - Filters	6% 19609	25		g0uZ		3	27 February 2011
	PHP - register globals	5% 15800	25		g0uZ		2	8 October 2011
	JWT - Unsecure File Signature	1% 2152	25		Nishacid , Mika		3	23 February 2023
	JWT - Weak secret	4% 11876	25		Jrmbt		6	21 August 2019
	JWT - Revoked token	2% 6021	25		ArnC		6	20 March 2020
	File upload - Null byte	7% 23777	25		g0uZ		4	26 December 2012
	Directory traversal	10% 35074	25		g0uZ		3	31 July 2011
	PHP - Apache configuration	1% 2376	25		erk3 , nemoz		4	8 July 2022
	Node - Eval	1% 2932	30		Mhd_Root		7	24 February 2021
	XSLT - Code execution	2% 3719	30		ghozt		5	16 July 2017
	SQL injection - String	7% 21792	30		g0uZ		10	24 December 2012
	SQL injection - Authentication - GBK	3% 9752	30		dvor4x		4	2 December 2015
	SQL injection - Authentication	14% 45676	30		g0uZ		11	27 February 2011
	Remote File Inclusion	4% 11762	30		g0uZ		8	25 November 2015
	PHP - type juggling	3% 8847	30		vic		4	10 March 2016
	PHP - preg_replace()	3% 9050	30		sambecks		4	2 March 2016
	PHP - Loose Comparison	3% 7262	30		ghozt		4	10 January 2018
	Nginx - SSRF Misconfiguration	1% 63	30		.Yo0x		0	27 September 2024
	Local File Inclusion	8% 25470	30		g0uZ		4	2 October 2011
	JWT - Header Injection	1% 1169	30		Nishacid , Mika		2	23 February 2023
	JWT - Public key	2% 3836	30		Jrmbt		5	21 August 2019
	Java - Server-side Template Injection	4% 10596	30		righettod		6	29 November 2015
	Command injection - Filter bypass	3% 7616	30		sambecks		6	20 September 2017
	GraphQL - Injection	1% 761	30		apges01		2	19 January 2023
	Flask - Development server	1% 921	30		Sanlokii		1	29 November 2023
	File upload - ZIP	3% 9548	30		ghozt		3	3 August 2017
	Local File Inclusion - Double encoding	4% 12814	30		zM_		4	13 June 2016
	SQL injection - Numeric	5% 15040	35		g0uZ		7	24 December 2012
	Yaml - Deserialization	1% 1395	35		Nishacid		2	20 April 2021
	XPath injection - Authentication	2% 6599	35		g0uZ		6	27 December 2012
	XML External Entity	2% 5638	35		sambecks		2	20 October 2014
	SQL Truncation	2% 6757	35		Geluchat		2	1 May 2015
	SQL Injection - Routed	2% 5398	35		soka		5	24 December 2016
	NoSQL injection - Authentication	3% 7674	35		mastho		8	31 May 2015
	PHP - Serialization	2% 6731	35		Arod		3	3 February 2014
	PHP - Path Truncation	2% 5443	35		Geluchat		6	25 March 2015
	Node - Serialize	1% 1275	35		Mhd_Root		2	24 February 2021
	LDAP injection - Authentication	3% 10356	35		g0uZ		8	26 May 2013
	JWT - Unsecure Key Handling	1% 763	35		Nishacid , Mika		5	23 February 2023
	Elixir - EEx	1% 267	35		lolo42		1	29 November 2023
	PHP - Eval - Advanced filters bypass	1% 596	40		Podalirius		2	8 July 2022
	XPath injection - String	2% 3922	40		g0uZ		5	26 May 2013
	SQL injection - File reading	2% 6020	40		Arod		3	19 October 2014
	SQL injection - Insert	1% 3183	40		sambecks		4	23 February 2015
	SQL injection - Error	3% 7838	40		sambecks		5	4 March 2015
	GraphQL - Mutation	1% 1573	40		CanardMandarin		2	20 October 2020
	PHP - Eval	2% 3622	40		chmod		10	8 November 2018
	Local File Inclusion - Wrappers	2% 3636	40		sambecks		4	2 March 2016
	Java - Spring Boot	1% 2335	40		dvor4x		3	24 December 2016
	GraphQL - Backend injection	1% 434	40		apges01		1	19 January 2023
	API - Broken Access 2	1% 432	40		Nishacid , Mika		1	18 January 2024
	File upload - Polyglot	1% 455	45		Cyxo		1	8 July 2022
	NodeJS - Prototype Pollution Bypass	1% 534	45		Worty		1	22 October 2021
	NoSQL injection - Blind	1% 3018	45		ghozt		6	26 November 2016
	SQL injection - Time based	2% 5788	45		ycam		4	11 September 2015
	SQL injection - Blind	3% 7666	50		g0uZ		6	27 February 2011
	NodeJS - vm escape	1% 741	50		Podalirius		1	15 April 2021
	Server Side Request Forgery	1% 1898	50		sambecks		7	22 June 2018
	Java - Custom gadget deserialization	1% 171	50		Elweth		0	28 December 2023
	LDAP injection - Blind	1% 3460	55		g0uZ		2	8 June 2013
	PHP - Unserialize overflow	1% 778	55		mayfly		2	4 April 2020
	PHP - Unserialize Pop Chain	1% 685	55		Worty		2	22 October 2021
	SQL Injection - Second Order	1% 210	55		k4ndar3c		1	29 November 2023
	Python - dotenv	1% 25	70		jrjgjk		0	27 September 2024
	Python - Blind SSTI Filters Bypass	1% 659	75		Podalirius		5	7 September 2021
	XPath injection - Blind	1% 2340	75		g0uZ		5	27 December 2012
	SQL injection - Filter bypass	1% 2887	80		sambecks		7	21 July 2014

Challenge Results

Pseudo	Challenge	Lang	Date
kappacite	CRLF		21 January 2025 at 16:00
Jesiontrop	XML External Entity		21 January 2025 at 15:59
Vinz	HTTP - Headers		21 January 2025 at 15:58
Gokulraj	Insecure Code Management		21 January 2025 at 15:56
ryzwannj	PHP - Register globals		21 January 2025 at 15:53
Jonas	HTTP - User-agent		21 January 2025 at 15:52
ryzwannj	PHP - Filters		21 January 2025 at 15:52
nf.esteves89	HTML - Code source		21 January 2025 at 15:52
ryzwannj	File upload - Null byte		21 January 2025 at 15:50
ringostar	HTML - Code source		21 January 2025 at 15:49