Web Security
Web challenges test your ability to find and exploit vulnerabilities in websites and APIs. Topics range from classic injection attacks to modern OAuth/JWT flaws, SSRF, GraphQL abuse, and prototype pollution.
Web security is the practice of finding and fixing vulnerabilities in websites, web applications, and APIs. Attackers exploit these flaws to steal data, hijack accounts, execute commands on servers, or pivot deeper into an organisation's infrastructure.
It is one of the most impactful security disciplines because nearly every business has a public-facing web presence. A single misconfigured endpoint can expose millions of user records.
In a CTF, you are given a URL (or a source-code dump) and must find a vulnerability to read a hidden flag. Challenges are self-contained web apps that deliberately contain one or more bugs — your job is to discover and exploit them before other teams.
Common workflows: intercept HTTP traffic with Burp Suite → inspect parameters and cookies → fuzz inputs → research the bug class → craft a proof-of-concept → extract the flag from the server response or database.
Sample Challenge
?sort= query parameter.
The application passes this value directly into a SQL ORDER BY clause — sanitising only for spaces.
There is no visible error output, making this a blind SQL injection.- Intercept the
GET /products?sort=namerequest in Burp Suite. - Notice the parameter is reflected in an
ORDER BYclause by testingsort=name ASCvssort=name DESC. - Use a boolean-based payload:
sort=(CASE WHEN 1=1 THEN name ELSE price END)— the order changes, confirming blind injection. - Write a Python loop using
SUBSTR()to extract theflagcolumn from thesecretstable letter by letter. - Assemble the bytes into the flag string.