Web - Server

Discover the mechanisms, protocols and technologies used on the Internet and learn to abuse them!

These challenges are designed to train users on HTML, HTTP and other server side mechanisms. The following series of challenges will cultivate a better understanding of techniques such as : Basic workings of multiple authentication mechanisms, handling form data, inner workings of web applications, etc. ...

Prerequisites:
– Understand HTML.
– Understand the HTTP protocol.
– Ability to manipulate a web browser.

97 Challenges

Results	Name	Validations	Number of points	Difficulty	Author	Note ↓↑	Solution	Date
	Java - Custom gadget deserialization	1% 244	50		Elweth		0	28 December 2023
	Yaml - Deserialization	1% 1538	35		Nishacid		2	20 April 2021
	Flask - Unsecure session	1% 3191	20		Sanlokii		1	29 November 2023
	NodeJS - vm escape	1% 812	50		Podalirius		1	15 April 2021
	Node - Eval	1% 3140	30		Mhd_Root		7	24 February 2021
	NoSQL injection - Blind	1% 3171	45		ghozt		6	26 November 2016
	Python - Server-side Template Injection Introduction	2% 5010	25		Podalirius		7	7 September 2021
	Java - Server-side Template Injection	4% 11127	30		righettod		6	29 November 2015
	JWT - Introduction	5% 18295	20		Kn0wledge		5	21 August 2019
	PHP - Unserialize Pop Chain	1% 774	55		Worty		2	22 October 2021
	PHP - Loose Comparison	3% 7554	30		ghozt		4	10 January 2018
	JWT - Header Injection	1% 1423	30		Nishacid , Mika		2	23 February 2023
	PHP - Filters	6% 20329	25		g0uZ		3	27 February 2011
	Python - dotenv	1% 123	70		jrjgjk		1	27 September 2024
	XPath injection - String	2% 4070	40		g0uZ		5	26 May 2013
	SQL injection - Numeric	5% 15739	35		g0uZ		7	24 December 2012
	XPath injection - Authentication	2% 6844	35		g0uZ		6	27 December 2012
	File upload - MIME type	8% 29087	20		g0uZ		10	26 December 2012
	Python - Blind SSTI Filters Bypass	1% 727	75		Podalirius		5	7 September 2021
	SQL injection - String	7% 22688	30		g0uZ		10	24 December 2012
	SQL injection - Authentication	13% 47697	30		g0uZ		11	27 February 2011
	PHP - preg_replace()	3% 9363	30		sambecks		4	2 March 2016
	File upload - ZIP	3% 10034	30		ghozt		3	3 August 2017
	XPath injection - Blind	1% 2469	75		g0uZ		5	27 December 2012
	JWT - Weak secret	4% 12718	25		Jrmbt		7	21 August 2019
	Local File Inclusion	8% 26303	30		g0uZ		4	2 October 2011
	HTML - Source code	48% 175192	5		g0uZ		6	3 October 2006
	PHP - Command injection	19% 69236	10		sambecks		10	20 September 2017
	HTTP - Verb tampering	13% 47746	15		g0uZ		10	3 February 2011
	File upload - Double extensions	10% 36075	20		g0uZ		10	24 December 2012
	Insecure Code Management	4% 14404	20		Swissky		6	29 September 2019
	PHP - Eval - Advanced filters bypass	1% 671	40		Podalirius		2	8 July 2022
	API - Mass Assignment	1% 3639	20		Nishacid , Mika		2	18 January 2024
	LDAP injection - Authentication	3% 10712	35		g0uZ		8	26 May 2013
	Remote File Inclusion	4% 12202	30		g0uZ		8	25 November 2015
	SQL injection - Blind	3% 8013	50		g0uZ		6	27 February 2011
	Local File Inclusion - Wrappers	2% 3817	40		sambecks		4	2 March 2016
	XSS - Server Side	1% 3187	20		Elf		4	23 June 2023
	Directory traversal	10% 36478	25		g0uZ		3	31 July 2011
	GraphQL - Mutation	1% 1653	40		CanardMandarin		2	20 October 2020
	HTTP - POST	14% 51342	15		Th1b4ud		10	14 August 2018
	HTTP - Improper redirect	12% 43928	15		Arod		10	26 November 2014
	SQL injection - Error	3% 8316	40		sambecks		5	4 March 2015
	HTTP - Cookies	13% 47038	20		g0uZ		8	7 October 2006
	PHP - type juggling	3% 9148	30		vic		4	10 March 2016
	NoSQL injection - Authentication	3% 8002	35		mastho		8	31 May 2015
	Nginx - Alias Misconfiguration	1% 3256	15		.Yo0x		3	27 September 2024
	PHP - Serialization	2% 6970	35		Arod		3	3 February 2014
	HTTP - Directory indexing	22% 79605	15		g0uZ		7	7 October 2006
	Node - Serialize	1% 1401	35		Mhd_Root		2	24 February 2021
	LDAP injection - Blind	1% 3582	55		g0uZ		2	8 June 2013
	Local File Inclusion - Double encoding	4% 13294	30		zM_		4	13 June 2016
	XML External Entity	2% 5855	35		sambecks		2	20 October 2014
	PHP - assert()	5% 16042	25		Birdy42		10	26 November 2016
	PHP - Unserialize overflow	1% 819	55		mayfly		2	4 April 2020
	SQL Truncation	2% 7036	35		Geluchat		2	1 May 2015
	PHP - Eval	2% 3801	40		chmod		10	8 November 2018
	HTTP - IP restriction bypass	9% 31704	10		Cyrhades		8	23 March 2021
	SQL injection - File reading	2% 6117	40		Arod		3	19 October 2014
	SQL injection - Time based	2% 6054	45		ycam		4	11 September 2015
	File upload - Null byte	7% 24757	25		g0uZ		4	26 December 2012
	Ruby on Rails - ransack	1% 46	30		koma		0	23 June 2025
	SQL injection - Insert	1% 3309	40		sambecks		4	23 February 2015
	PHP - register globals	5% 16350	25		g0uZ		2	8 October 2011
	JWT - Unsecure File Signature	1% 2640	25		Nishacid , Mika		3	23 February 2023
	SQL Injection - Routed	2% 5650	35		soka		5	24 December 2016
	Elixir - EEx	1% 385	35		lolo42		1	29 November 2023
	JWT - Unsecure Key Handling	1% 942	35		Nishacid , Mika		5	23 February 2023
	HTTP - Headers	16% 56402	15		Arod		9	11 January 2015
	GraphQL - Backend injection	1% 505	40		apges01		1	19 January 2023
	Nginx - Root Location Misconfiguration	1% 1533	15		.Yo0x		1	27 September 2024
	GraphQL - Injection	1% 928	30		apges01		2	19 January 2023
	Server Side Request Forgery	1% 1999	50		sambecks		7	22 June 2018
	HTTP - Open redirect	19% 69109	10		Swissky		10	2 August 2017
	XSLT - Code execution	2% 3877	30		ghozt		5	16 July 2017
	Install files	13% 45078	15		g0uZ		7	7 October 2006
	SQL injection - Filter bypass	1% 3101	80		sambecks		7	21 July 2014
	API - Broken Access	2% 5964	15		Nishacid , Mika		4	18 January 2024
	Command injection - Filter bypass	3% 7971	30		sambecks		6	20 September 2017
	File upload - Polyglot	1% 526	45		Cyxo		1	8 July 2022
	HTTP - User-agent	24% 86772	10		g0uZ		10	3 October 2006
	PHP - Apache configuration	1% 2733	25		erk3 , nemoz		4	8 July 2022
	Backup file	16% 55738	15		g0uZ		10	27 February 2011
	SQL Injection - Second Order	1% 265	55		k4ndar3c		1	29 November 2023
	API - Broken Access 2	1% 637	40		Nishacid , Mika		1	18 January 2024
	Weak password	31% 113253	10		g0uZ		7	3 October 2006
	Flask - Development server	1% 1212	30		Sanlokii		1	29 November 2023
	PHP - Path Truncation	2% 5607	35		Geluchat		6	25 March 2015
	JWT - Public key	2% 4130	30		Jrmbt		5	21 August 2019
	GraphQL - Introspection	2% 4234	20		apges01		4	19 January 2023
	NodeJS - Prototype Pollution Bypass	1% 601	45		Worty		1	22 October 2021
	Java - Spring Boot	1% 2425	40		dvor4x		3	24 December 2016
	Nginx - SSRF Misconfiguration	1% 366	30		.Yo0x		1	27 September 2024
	SQL injection - Authentication - GBK	3% 10253	30		dvor4x		4	2 December 2015
	CRLF	9% 32584	20		g0uZ		7	31 July 2011
	PHP - Remote Xdebug	1% 1577	25		mayfly		4	18 March 2020
	JWT - Revoked token	2% 6583	25		ArnC		6	20 March 2020

Challenge Results

Pseudo	Challenge	Lang	Date
Hackamaru	JWT - Clé publique		25 July 2025 at 15:08
el.vangador	Flask - Unsecure session		25 July 2025 at 15:07
Peter17	Nginx - Root Location Misconfiguration		25 July 2025 at 15:07
stepandx	API - Broken Access		25 July 2025 at 15:04
PhillLewis	LDAP injection - Blind		25 July 2025 at 15:04
he4am	GraphQL - Injection		25 July 2025 at 14:58
BadZ_	LDAP injection - Authentification		25 July 2025 at 14:54
evol	HTTP - Directory indexing		25 July 2025 at 14:53
ml6	SQL injection - Time based		25 July 2025 at 14:49
Test	SQL Injection - Second Order		25 July 2025 at 14:49