First steps in web CTFs
While hunting flags in small single-flaw web puzzles you build habits of exploring, changing requests and gathering evidence, and you write a fix proposal for every flag.
Level 101 · 15 lessons · 12 practice labs
Lessons
Warm-up
- How to solve a web puzzle: explore, try, evidence
- A flag hidden in page source and comments
- A flag in robots.txt and forgotten directories
- A flag unlocked by changing a cookie
- Short task: three flags in three mini apps
Playing with requests
- A page left open to the wrong HTTP method
- A check that trusts a header: Referer and User-Agent
- Decoding and changing an encoded parameter
- Reaching someone else’s record by its sequence number
- Short task: collect four flags with Burp Repeater
Mixed puzzles
- SQL injection in a simple login form
- A flag instead of an alert box: simple reflected XSS
- A file read that climbs out of its folder with ../
- Writing a solution note and a fix proposal
- Capstone: a mixed web app with six flags
Practice labs
- A flag hidden in a page-source comment: Find the flag in a forgotten comment in the mini app's page source and propose a build step that strips comments before release.
- The folder robots.txt points to: Find the flag in the folder robots.txt tries to hide and write a recommendation to protect it with access control.
- A hidden endpoint in a JavaScript file: Extract a hidden endpoint from the app's minified JavaScript, take the flag there and explain why the endpoint was left open.
- A flag from a forgotten backup file: Find a backup file left on the server, reach the flag through the configuration inside it and write a server rule that blocks backup files.
- Change the cookie, become admin: Take the flag by changing a cookie that carries the role in plain text and write the server-side session fix in one sentence.
- A page that only protects POST: Reach a page that only checks POST requests through another method, take the flag and extend the check to every method.
- A download that trusts the Referer header: Fool the download page that grants access by the Referer header with Repeater, take the flag and propose a proper authorisation check.
- A user ID encoded in hex and Base64: Decode and change a double-encoded user ID to reach the flag in the admin record and explain why encoding is not protection.
- A simple login form and a single quote: Take the flag through injection in a simple login form and write how to fix it with a parameterised query.
- A reflected XSS that reveals the flag: Prove the reflected XSS in the search page with a harmless script, read the flag on the page and fix it with output encoding.
- A file viewer that walks out of its folder: Prove the file viewer leaves its folder, read the flag file and propose a canonical path check.
- A mixed app with three flags and a write-up: Collect the flags from a mini shop with three different flaws and write a short write-up with the root cause and fix for each.
About this course
While hunting flags in small single-flaw web puzzles you build habits of exploring, changing requests and gathering evidence, and you write a fix proposal for every flag.
What you will learn
- Warm-up
- Playing with requests
- Mixed puzzles
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.