Math Solver
Automate solving 100 consecutive linear equations within a single HTTP session to unlock the flag.
Python
Bank Logic Bypass — Scientific Notation Bypasses Integer Validation
Submit a withdrawal amount in scientific notation to exploit loose type parsing and credit 1 billion to your balance.
Basic Calculator — Variable Shadowing Bug
Identify and work around a Python variable shadowing bug where a function definition overwrites a string variable of the same name.
Blind SQLi Login — Boolean-Based Character Extraction
Boolean blind SQL injection on a login form to extract a password character by character using HEX comparison.
Unzip Matryoshka — 3000 Nested Zip Files
Automate extraction of 3000 nested zip files to retrieve the flag from the innermost archive.
A Too Small Reminder — Session ID Enumeration
Register, log in, notice the session_id cookie is a small integer. Brute-force integers upward from 30 until the admin session is hit and the flag appears.
Basic SQLi — Classic OR 1=1 Login Bypass
Inject ’ OR ‘1’=‘1 into both username and password fields to make the SQL query always true and grab the flag from the response.
C-Style Login — PHP Type Juggling Array Bypass
PHP’s loose comparison treats an array as truthy against any string. Sending password[] as an array in the POST body bypasses the string comparison and grants access.
Chaos — TCP Payload Reconstruction from PCAP
Filter a PCAP for TCP packets, decode each packet’s payload from hex, and concatenate them in order — the resulting byte stream contains the flag.
Click Me — Cookie Integer Forge to Reach Counter Target
The app tracks clicks with an integer cookie. Skip the clicking by setting ‘cookies’ to 10000000 directly and request the page — the server trusts the cookie value and returns the flag.