Web - Server

Discover the mechanisms, protocols and technologies used on the Internet and learn to abuse them!

These challenges are designed to train users on HTML, HTTP and other server side mechanisms. The following series of challenges will cultivate a better understanding of techniques such as : Basic workings of multiple authentication mechanisms, handling form data, inner workings of web applications, etc. ...

Prerequisites:
– Understand HTML.
– Understand the HTTP protocol.
– Ability to manipulate a web browser.

83 Challenges

Results	Name	Validations	Number of points	Difficulty	Author ↓↑	Note	Solution	Date
	JWT - Revoked token	2% 4006	25		ArnC		6	20 March 2020
	SQL injection - File reading	2% 4881	40		Arod		3	19 October 2014
	PHP - Serialization	3% 5894	35		Arod		3	3 February 2014
	HTTP - Headers	16% 45043	15		Arod		9	11 January 2015
	HTTP - Improper redirect	13% 35155	15		Arod		10	26 November 2014
	PHP - assert()	5% 12943	25		Birdy42		10	26 November 2016
	GraphQL - Mutation	1% 1199	40		CanardMandarin		2	20 October 2020
	HTTP - IP restriction bypass	6% 15799	10		Cyrhades		7	23 March 2021
	File upload - Polyglot	1% 200	45		Cyxo		1	8 July 2022
	SQL Truncation	2% 5468	35		Geluchat		2	1 May 2015
	PHP - Path Truncation	2% 4710	35		Geluchat		6	25 March 2015
	JWT - Weak secret	4% 8808	25		Jrmbt		6	21 August 2019
	JWT - Public key	2% 2875	30		Jrmbt		5	21 August 2019
	JWT - Introduction	5% 12422	20		Kn0wledge		5	21 August 2019
	Node - Eval	1% 2113	30		Mhd_Root		7	24 February 2021
	Node - Serialize	1% 872	35		Mhd_Root		1	24 February 2021
	Yaml - Deserialization	1% 934	35		Nishacid		2	20 April 2021
	JWT - Header Injection	1% 166	30		Nishacid		1	23 February 2023
	JWT - Unsecure Key Handling	1% 109	35		Nishacid		0	23 February 2023
	JWT - Unsecure File Signature	1% 245	25		Nishacid		3	23 February 2023
	Python - Server-side Template Injection Introduction	1% 2770	25		Podalirius		6	7 September 2021
	NodeJS - vm escape	1% 496	50		Podalirius		1	15 April 2021
	PHP - Eval - Advanced filters bypass	1% 286	40		Podalirius		1	8 July 2022
	Python - Blind SSTI Filters Bypass	1% 373	75		Podalirius		4	7 September 2021
	HTTP - Open redirect	19% 54014	10		Swissky		10	2 August 2017
	Insecure Code Management	4% 10455	20		Swissky		6	29 September 2019
	HTTP - POST	14% 39224	15		Th1b4ud		10	14 August 2018
	NodeJS - Prototype Pollution Bypass	1% 260	45		Worty		1	22 October 2021
	PHP - Unserialize Pop Chain	1% 347	55		Worty		2	22 October 2021
	GraphQL - Backend injection	1% 38	40		apges01		0	19 January 2023
	GraphQL - Injection	1% 46	30		apges01		0	19 January 2023
	GraphQL - Introspection	1% 767	20		apges01		1	19 January 2023
	PHP - Eval	2% 2905	40		chmod		10	8 November 2018
	Java - Spring Boot	1% 1953	40		dvor4x		3	24 December 2016
	SQL injection - Authentication - GBK	3% 7794	30		dvor4x		4	2 December 2015
	PHP - Apache configuration	1% 968	25		erk3		2	8 July 2022
	Backup file	16% 45693	15		g0uZ		9	27 February 2011
	XPath injection - Blind	1% 1890	75		g0uZ		4	27 December 2012
	SQL injection - Numeric	5% 11893	35		g0uZ		6	24 December 2012
	CRLF	10% 26479	20		g0uZ		7	31 July 2011
	LDAP injection - Blind	1% 2867	55		g0uZ		2	8 June 2013
	Weak password	32% 91600	10		g0uZ		7	3 October 2006
	SQL injection - Blind	3% 6183	50		g0uZ		5	27 February 2011
	XPath injection - Authentication	3% 5798	35		g0uZ		6	27 December 2012
	HTTP - User-agent	24% 68575	10		g0uZ		10	3 October 2006
	XPath injection - String	2% 3378	40		g0uZ		5	26 May 2013
	LDAP injection - Authentication	4% 8808	35		g0uZ		8	26 May 2013
	HTML - Source code	49% 139391	5		g0uZ		5	3 October 2006
	Directory traversal	11% 29515	25		g0uZ		3	31 July 2011
	SQL injection - String	7% 17266	30		g0uZ		9	24 December 2012
	File upload - Null byte	8% 20230	25		g0uZ		4	26 December 2012
	Install files	13% 37028	15		g0uZ		5	7 October 2006
	HTTP - Cookies	14% 37665	20		g0uZ		8	7 October 2006
	HTTP - Verb tampering	14% 38637	15		g0uZ		10	3 February 2011
	PHP - Filters	6% 16927	25		g0uZ		3	27 February 2011
	PHP - register globals	5% 13778	25		g0uZ		2	8 October 2011
	File upload - MIME type	9% 23121	20		g0uZ		10	26 December 2012
	Local File Inclusion	8% 21887	30		g0uZ		4	2 October 2011
	HTTP - Directory indexing	23% 64367	15		g0uZ		7	7 October 2006
	File upload - Double extensions	11% 29157	20		g0uZ		9	24 December 2012
	Remote File Inclusion	4% 9962	30		g0uZ		8	25 November 2015
	SQL injection - Authentication	13% 37242	30		g0uZ		11	27 February 2011
	NoSQL injection - Blind	1% 2510	45		ghozt		6	26 November 2016
	File upload - ZIP	3% 7889	30		ghozt		3	3 August 2017
	PHP - Loose Comparison	3% 6212	30		ghozt		4	10 January 2018
	XSLT - Code execution	2% 3127	30		ghozt		5	16 July 2017
	NoSQL injection - Authentication	3% 6587	35		mastho		8	31 May 2015
	PHP - Remote Xdebug	1% 1108	25		mayfly		4	18 March 2020
	PHP - Unserialize overflow	1% 566	55		mayfly		2	4 April 2020
	Java - Server-side Template Injection	4% 8900	30		righettod		5	29 November 2015
	Server Side Request Forgery	1% 1362	50		sambecks		7	22 June 2018
	PHP - preg_replace()	3% 7938	30		sambecks		4	2 March 2016
	SQL injection - Insert	1% 2487	40		sambecks		4	23 February 2015
	SQL injection - Error	3% 6114	40		sambecks		5	4 March 2015
	Local File Inclusion - Wrappers	2% 2946	40		sambecks		4	2 March 2016
	XML External Entity	2% 4611	35		sambecks		2	20 October 2014
	Command injection - Filter bypass	3% 6282	30		sambecks		6	20 September 2017
	PHP - Command injection	19% 52783	10		sambecks		10	20 September 2017
	SQL injection - Filter bypass	1% 1863	80		sambecks		7	21 July 2014
	SQL Injection - Routed	2% 4168	35		soka		5	24 December 2016
	PHP - type juggling	3% 7793	30		vic		4	10 March 2016
	SQL injection - Time based	2% 4489	45		ycam		4	11 September 2015
	Local File Inclusion - Double encoding	4% 10918	30		zM_		4	13 June 2016

Challenge Results

Pseudo	Challenge	Lang	Date
Low	SQL Truncation		26 March 2023 at 04:54
Low	SQL Injection - Routed		26 March 2023 at 04:47
Low	SQL injection - Numérique		26 March 2023 at 04:38
haeliseu	JWT - Secret faible		26 March 2023 at 04:27
xLxt	HTML - Code source		26 March 2023 at 04:25
Profecy	Command injection - Filter bypass		26 March 2023 at 04:07
Meyriu	HTTP - Cookies		26 March 2023 at 03:52
RaX\|	PHP - Remote Xdebug		26 March 2023 at 03:42
Low	Remote File Inclusion		26 March 2023 at 03:32
alien	PHP - Command injection		26 March 2023 at 03:03