Web - Server Web - Server

Discover the mechanisms, protocols and technologies used on the Internet and learn to abuse them!

These challenges are designed to train users on HTML, HTTP and other server side mechanisms. The following series of challenges will cultivate a better understanding of techniques such as : Basic workings of multiple authentication mechanisms, handling form data, inner workings of web applications, etc. ...

Prerequisites:
– Understand HTML.
– Understand the HTTP protocol.
– Ability to manipulate a web browser.

challenges 97 Challenges

Results Name Validations Number of points  Explanation for the scores Difficulty  Difficulty Author Note  Notation Solution Date
validepas_valide HTML - Source code 47% 189365 5 g0uZ 6 3 October 2006
validepas_valide HTTP - IP restriction bypass 10% 38203 10 Cyrhades 8 23 March 2021
validepas_valide HTTP - Open redirect 19% 74784 10 Swissky 10 2 August 2017
validepas_valide HTTP - User-agent 24% 93592 10 g0uZ 10 3 October 2006
validepas_valide Weak password 30% 120952 10 g0uZ 7 3 October 2006
validepas_valide PHP - Command injection 19% 75338 10 sambecks 10 20 September 2017
validepas_valide API - Broken Access 3% 9575 15 Nishacid , Mika 4 18 January 2024
validepas_valide Backup file 15% 59190 15 g0uZ 10 27 February 2011
validepas_valide HTTP - Directory indexing 22% 84840 15 g0uZ 7 7 October 2006
validepas_valide HTTP - Headers 16% 60508 15 Arod 9 11 January 2015
validepas_valide HTTP - POST 14% 55548 15 Th1b4ud 10 14 August 2018
validepas_valide HTTP - Improper redirect 12% 46910 15 Arod 10 26 November 2014
validepas_valide HTTP - Verb tampering 13% 50814 15 g0uZ 10 3 February 2011
validepas_valide Install files 12% 47801 15 g0uZ 7 7 October 2006
validepas_valide Nginx - Alias Misconfiguration 2% 5794 15 .Yo0x 3 27 September 2024
validepas_valide Nginx - Root Location Misconfiguration 2% 4242 15 .Yo0x 2 27 September 2024
validepas_valide API - Mass Assignment 2% 5510 20 Nishacid , Mika 2 18 January 2024
validepas_valide CRLF 9% 34295 20 g0uZ 7 31 July 2011
validepas_valide File upload - Double extensions 10% 38459 20 g0uZ 10 24 December 2012
validepas_valide File upload - MIME type 8% 31075 20 g0uZ 10 26 December 2012
validepas_valide Flask - Unsecure session 2% 4501 20 Sanlokii 1 29 November 2023
validepas_valide GraphQL - Introspection 2% 5433 20 apges01 4 19 January 2023
validepas_valide HTTP - Cookies 13% 50237 20 g0uZ 8 7 October 2006
validepas_valide Insecure Code Management 4% 15698 20 Swissky 6 29 September 2019
validepas_valide JWT - Introduction 6% 20349 20 Kn0wledge 5 21 August 2019
validepas_valide XSS - Server Side 2% 4413 20 Elf 4 23 June 2023
validepas_valide Directory traversal 10% 38946 25 g0uZ 3 31 July 2011
validepas_valide File upload - Null byte 7% 26351 25 g0uZ 4 26 December 2012
validepas_valide JWT - Revoked token 2% 7713 25 ArnC 6 20 March 2020
validepas_valide JWT - Weak secret 4% 14195 25 Jrmbt 8 21 August 2019
validepas_valide JWT - Unsecure File Signature 1% 3560 25 Nishacid , Mika 3 23 February 2023
validepas_valide PHP - assert() 5% 17178 25 Birdy42 10 26 November 2016
validepas_valide PHP - Apache configuration 1% 3413 25 erk3 , nemoz 4 8 July 2022
validepas_valide PHP - Filters 6% 21541 25 g0uZ 3 27 February 2011
validepas_valide PHP - register globals 5% 17297 25 g0uZ 2 8 October 2011
validepas_valide PHP - Remote Xdebug 1% 1807 25 mayfly 4 18 March 2020
validepas_valide Python - Server-side Template Injection Introduction 2% 6039 25 Podalirius 7 7 September 2021
validepas_valide File upload - ZIP 3% 10990 30 ghozt 3 3 August 2017
validepas_valide Flask - Development server 1% 1691 30 Sanlokii 1 29 November 2023
validepas_valide GraphQL - Injection 1% 1400 30 apges01 2 19 January 2023
validepas_valide Command injection - Filter bypass 3% 8902 30 sambecks 6 20 September 2017
validepas_valide Java - Server-side Template Injection 3% 12029 30 righettod 6 29 November 2015
validepas_valide JWT - Public key 2% 4814 30 Jrmbt 5 21 August 2019
validepas_valide JWT - Header Injection 1% 1957 30 Nishacid , Mika 2 23 February 2023
validepas_valide Local File Inclusion 7% 28102 30 g0uZ 4 2 October 2011
validepas_valide Local File Inclusion - Double encoding 4% 14281 30 zM_ 4 13 June 2016
validepas_valide Nginx - SSRF Misconfiguration 1% 1165 30 .Yo0x 1 27 September 2024
validepas_valide Node - Eval 1% 3639 30 Mhd_Root 8 24 February 2021
validepas_valide PHP - Loose Comparison 3% 8150 30 ghozt 4 10 January 2018
validepas_valide PHP - preg_replace() 3% 9922 30 sambecks 4 2 March 2016
validepas_valide PHP - type juggling 3% 9735 30 vic 4 10 March 2016
validepas_valide Remote File Inclusion 4% 13056 30 g0uZ 8 25 November 2015
validepas_valide Ruby on Rails - ransack 1% 402 30 koma 0 23 June 2025
validepas_valide SQL injection - Authentication 13% 51423 30 g0uZ 11 27 February 2011
validepas_valide SQL injection - Authentication - GBK 3% 11186 30 dvor4x 4 2 December 2015
validepas_valide SQL injection - String 7% 24529 30 g0uZ 10 24 December 2012
validepas_valide XSLT - Code execution 2% 4241 30 ghozt 5 16 July 2017
validepas_valide Elixir - EEx 1% 649 35 lolo42 1 29 November 2023
validepas_valide JWT - Unsecure Key Handling 1% 1282 35 Nishacid , Mika 5 23 February 2023
validepas_valide LDAP injection - Authentication 3% 11375 35 g0uZ 8 26 May 2013
validepas_valide Node - Serialize 1% 1663 35 Mhd_Root 2 24 February 2021
validepas_valide NoSQL injection - Authentication 3% 8647 35 mastho 8 31 May 2015
validepas_valide PHP - Path Truncation 2% 5964 35 Geluchat 7 25 March 2015
validepas_valide PHP - Serialization 2% 7459 35 Arod 3 3 February 2014
validepas_valide SQL injection - Numeric 5% 17008 35 g0uZ 7 24 December 2012
validepas_valide SQL Injection - Routed 2% 6193 35 soka 5 24 December 2016
validepas_valide SQL Truncation 2% 7702 35 Geluchat 2 1 May 2015
validepas_valide XML External Entity 2% 6373 35 sambecks 2 20 October 2014
validepas_valide XPath injection - Authentication 2% 7265 35 g0uZ 6 27 December 2012
validepas_valide Yaml - Deserialization 1% 1783 35 Nishacid 2 20 April 2021
validepas_valide API - Broken Access 2 1% 1079 40 Nishacid , Mika 1 18 January 2024
validepas_valide GraphQL - Backend injection 1% 746 40 apges01 1 19 January 2023
validepas_valide GraphQL - Mutation 1% 1899 40 CanardMandarin 2 20 October 2020
validepas_valide Java - Spring Boot 1% 2613 40 dvor4x 3 24 December 2016
validepas_valide Local File Inclusion - Wrappers 2% 4228 40 sambecks 4 2 March 2016
validepas_valide PHP - Eval 2% 4251 40 chmod 10 8 November 2018
validepas_valide PHP - Eval - Advanced filters bypass 1% 872 40 Podalirius 2 8 July 2022
validepas_valide SQL injection - Error 3% 9244 40 sambecks 5 4 March 2015
validepas_valide SQL injection - Insert 1% 3634 40 sambecks 4 23 February 2015
validepas_valide SQL injection - File reading 2% 6776 40 Arod 3 19 October 2014
validepas_valide XPath injection - String 2% 4311 40 g0uZ 5 26 May 2013
validepas_valide File upload - Polyglot 1% 831 45 Cyxo 1 8 July 2022
validepas_valide NodeJS - Prototype Pollution Bypass 1% 715 45 Worty 1 22 October 2021
validepas_valide NoSQL injection - Blind 1% 3530 45 ghozt 6 26 November 2016
validepas_valide SQL injection - Time based 2% 6535 45 ycam 4 11 September 2015
validepas_valide Java - Custom gadget deserialization 1% 451 50 Elweth 0 28 December 2023
validepas_valide NodeJS - vm escape 1% 977 50 Podalirius 2 15 April 2021
validepas_valide Server Side Request Forgery 1% 2185 50 sambecks 7 22 June 2018
validepas_valide SQL injection - Blind 3% 8719 50 g0uZ 6 27 February 2011
validepas_valide LDAP injection - Blind 1% 3869 55 g0uZ 2 8 June 2013
validepas_valide PHP - Unserialize overflow 1% 990 55 mayfly 2 4 April 2020
validepas_valide PHP - Unserialize Pop Chain 1% 1014 55 Worty 2 22 October 2021
validepas_valide SQL Injection - Second Order 1% 456 55 k4ndar3c 1 29 November 2023
validepas_valide Python - dotenv 1% 323 70 jrjgjk 1 27 September 2024
validepas_valide Python - Blind SSTI Filters Bypass 1% 964 75 Podalirius 5 7 September 2021
validepas_valide XPath injection - Blind 1% 2739 75 g0uZ 5 27 December 2012
validepas_valide SQL injection - Filter bypass 1% 3632 80 sambecks 7 21 July 2014

Challenge Results Challenge Results

Pseudo Challenge Lang Date
5h4d0wx Web - Server  Install files en 13 October 2026 at 20:22
LaurentP Web - Serveur  Nginx - Alias Misconfiguration fr 13 October 2026 at 20:21
5h4d0wx Web - Server  PHP - register globals en 13 October 2026 at 20:21
5h4d0wx Web - Server  PHP - assert() en 13 October 2026 at 20:21
5h4d0wx Web - Server  PHP - type juggling en 13 October 2026 at 20:21
5h4d0wx Web - Server  Java - Server-side Template Injection en 13 October 2026 at 20:20
5h4d0wx Web - Server  Remote File Inclusion en 13 October 2026 at 20:19
5h4d0wx Web - Server  LDAP injection - Authentication en 13 October 2026 at 20:19
ExegolInitiative Web - Server  API - Mass Assignment en 13 October 2026 at 20:17
ᖒᕾᕲᙉᕩᔾ Web - Serveur  Java - Custom gadget deserialisation fr 13 October 2026 at 20:17