CTE Security Challenges

Deliberately vulnerable apps for hands-on web security training.

XSS · SQLi · SSRF · RCE — 3 levels each.

</>

Cross-Site Scripting

Inject JavaScript that runs in a victim's browser.

Level 1
Reflected
Input echoed straight into the page
xss1.hadrian-challenges.com
Level 2
Stored
Payload persists in a guestbook
xss2.hadrian-challenges.com
Level 3
DOM-based
innerHTML sink + blacklist bypass
xss3.hadrian-challenges.com
DB

SQL Injection

Rewrite a database query by injecting SQL.

Level 1
Auth bypass
Log in without the password
sqli1.hadrian-challenges.com
Level 2
UNION-based
Dump a hidden secrets table
sqli2.hadrian-challenges.com
Level 3
Blind boolean
Leak data one bit at a time
sqli3.hadrian-challenges.com
→

Server-Side Request Forgery

Make the server fetch internal resources for you.

Level 1
Blocklist bypass
Beat the 127.0.0.1 filter
ssrf1.hadrian-challenges.com
Level 2
Cloud metadata
Steal instance credentials
ssrf2.hadrian-challenges.com
Level 3
Scheme & redirect
Defeat a host allowlist
ssrf3.hadrian-challenges.com
../

Path Traversal

Escape a web root to read files elsewhere on the filesystem.

Level 1
Basic ../
Walk out of the document root
pt1.hadrian-challenges.com
Level 2
Filter bypass
Defeat a naive ../ stripper
pt2.hadrian-challenges.com
Level 3
Absolute path
os.path.join() throws away the root
pt3.hadrian-challenges.com
⚡

Remote Code Execution

Run your own code/commands on the server.

Level 1
Command injection
Shell metacharacters in a ping tool
rce1.hadrian-challenges.com
Level 2
Template injection
Jinja2 SSTI to Python execution
rce2.hadrian-challenges.com
Level 3
eval() escape
Break out of a restricted eval
rce3.hadrian-challenges.com
{ }

Prototype Pollution

Real Node.js: poison Object.prototype via a careless merge.

Level 1
__proto__
Pollute Object.prototype to become admin
pp1.hadrian-challenges.com
Level 2
Config gadget
Flip an inherited debug flag
pp2.hadrian-challenges.com
Level 3
PP → RCE
Chain into an EJS template RCE
pp3.hadrian-challenges.com
⇆

Request Smuggling

Desync a proxy and back-end to smuggle a hidden request.

Level 1
CL.TE
Content-Length vs chunked desync
rs1.hadrian-challenges.com:8061
Level 2
TE.CL
Chunked vs Content-Length desync
rs2.hadrian-challenges.com:8062
Level 3
TE.TE
Obfuscate the Transfer-Encoding header
rs3.hadrian-challenges.com:8063