Web Exploitation
// 9 published technical guides
Web challenges test your ability to find and exploit vulnerabilities in web applications: SQL injection, cross-site scripting, broken authentication, server-side request forgery, and more. They are the most common category in beginner CTFs because the attack surface is familiar and the tooling is light.
› reference guides
- 01beginner
HTTP Basics for CTF
Understand requests, responses, methods, headers, and cookies — the foundation of every web challenge.
- 02intermediate
SQL Injection
Manipulate database queries by injecting SQL through unsanitized input to bypass auth and dump data.
- 03intermediate
Cross-Site Scripting (XSS)
Inject JavaScript into pages viewed by other users to steal sessions or perform actions on their behalf.
- 04intermediate
Cross-Site Request Forgery (CSRF)
Trick authenticated victims into executing state-changing actions on a target application without their knowledge.
- 05intermediate
Server-Side Request Forgery (SSRF)
Abuse web application request handlers to make unauthorized HTTP or socket requests to internal networks and cloud metadata APIs.
- 06beginner
OS Command Injection
Execute arbitrary system shell commands on the hosting server by injecting shell operators into unsanitized input.
- 07intermediate
File Inclusion & Path Traversal
Access arbitrary system files and achieve Remote Code Execution via Local File Inclusion (LFI), Remote File Inclusion (RFI), and PHP stream wrappers.
- 08intermediate
JWT Attacks & Bypass
Crack weak signing secrets, exploit signature verification flaws, and abuse algorithm confusion in JSON Web Tokens.
- 09advanced
Server-Side Template Injection (SSTI)
Escape template engine sandboxes (Jinja2, Twig, Smarty, ERB) to read sensitive files and execute remote code on the target server.