Web CTF arena
You collect flags in intermediate puzzles covering server-side, client-side and identity flaws, chain small flaws together and write a fix note for every solution.
Level 301 · 15 lessons · 13 practice labs
Lessons
Server-side puzzles
- A flag letter by letter through blind SQL injection
- A configuration file read through template injection
- A flag on an internal service via SSRF
- A flag hidden behind an XML upload
- Short task: collect four server-side flags and write a fix for each
Client and identity puzzles
- Stored XSS on a page the admin bot visits
- The admin role through a weakly signed JWT
- A code captured through a loose redirect_uri
- Moving the flag to your own account through an unprotected action
- Short task: collect four client and identity flags
Chains
- Logic and a race: a coupon spent twice
- A hidden field found through GraphQL introspection
- The serialized object in a cookie
- Chaining three small flaws
- Capstone: a timed mixed arena with solution notes
Practice labs
- The first character through blind injection: Extract the first characters of the flag through true-false responses with blind injection and write the fix in one sentence.
- A config flag through template injection: Read the flag in the configuration through template injection in a greeting card feature and write a fix note.
- A flag on an internal service through SSRF: Reach the flag on an internal service through an image import feature and write the allow-list fix.
- The flag behind an XML upload: Read the flag file through XXE in an invoice import feature and write the parser fix.
- The admin flag through a weakly signed JWT: Take the flag by changing the role in a token signed with a weak key and write the right key management.
- Transferring the flag through an unprotected action: Move the flag to your own account through a transfer action with no CSRF protection and write the token fix.
- The comment the admin bot reads: Take the flag through stored XSS on a page the admin bot visits and write the output-encoding fix.
- A code captured through a loose redirect_uri: Capture the bot user's code through a loose redirect_uri on the lab OAuth server, take the flag and write the exact-match fix.
- A hidden field through GraphQL introspection: Query the flag in a hidden field found through introspection and write how to protect the field.
- The serialised object in the cookie: Take the flag by changing a field in the serialised object in the cookie and write the signed-JSON fix.
- A coupon spent twice: Take the flag by using a single-use coupon twice with simultaneous requests and write the atomic fix.
- Chain three small flaws: Reach the flag by chaining an open redirect, weak CORS and an IDOR and name the cheapest fix that breaks the chain.
- A timed mixed arena with write-ups: Collect five flags in the timed arena and write a write-up with root cause and fix for each.
About this course
You collect flags in intermediate puzzles covering server-side, client-side and identity flaws, chain small flaws together and write a fix note for every solution.
What you will learn
- Server-side puzzles
- Client and identity puzzles
- Chains
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.