CTF web challenges

When it applies

The handout is a URL (sometimes plus source). The goal is almost always to read a flag file (/flag, /flag.txt, an env var, or a DB row) — so every bug you find should be steered toward read a file, run a command, or become admin. This skill is the CTF routing layer; work the deep techniques with web-ssti, web-ssrf, web-sqli, web-lfi-path-traversal, web-auth-jwt, web-deserialization, web-command-injection, web-file-upload.

Why it works

CTF web challenges strip an app to one intended bug plus decorations, so the surface is small and the bug is findable by enumeration, not luck. Provided source turns black-box guessing into reading comprehension; the framework banner (Flask/PHP/Express) predicts the bug class before you send a request.

Method

1. Enumerate the obvious first (5 minutes). curl -sS -D- the root; read every HTML comment, JS file, cookie, and header. Hit robots.txt, /sitemap.xml, common admin paths, and run a quick ffuf -w raft-small-words -u <url>/FUZZ. Check the HTTP methods (OPTIONS, try PUT/POST where GET works). CTF apps hide routes in comments and robots more than real ones.
2. Grab source if it exists — it usually does.
   • Provided zip / Dockerfile: read it; the bug is visible, and the Dockerfile tells you the flag's location and any sandbox (read-only fs, seccomp).
   • .git exposed: git-dumper <url>/.git out/ then read history (recon-github-code-leaks).
   • Backups: index.php~, index.php.bak, .index.php.swp, app.py.bak — ffuf for them.
   • PHP filters as source oracle: ?page=php://filter/convert.base64-encode/resource=index (web-lfi-path-traversal).
   • Flask/Werkzeug debugger page exposed → the PIN is crackable from machine-id + boot-id + username (leak them via an LFI) or is printed in console output you can reach.
3. Work the framework's favorite bug:
   • Flask/Jinja2 → SSTI: {{7*7}} then climb to {{ self.__init__.__globals__ }} / config / cycler.__init__.__globals__.os.popen('cat /flag').read(). Filter bypasses: |attr(), request-args gadgets, hex/octal string building (web-ssti, web-python-sandbox-escape).
   • PHP → the quirks are the challenge: loose comparison type juggling (== with "0e..." magic hashes, 0 == "password", array params to skip strcmp/md5 checks — ?a[]=1), wrapper chains (php://filter, data://, phar://), preg_replace /e, unserialize with a provided class → POP chain (web-deserialization).
   • Node/Express → prototype pollution (web-prototype-pollution), SSTI in EJS/Pug, eval on JSON fields, NoSQL injection ({"$gt":""} on login forms).
4. Play the cookie games. Flask session cookie → flask-unsign --decode, brute the secret (flask-unsign --unsign --wordlist rockyou.txt) then re-sign {'is_admin': True}. JWT → alg:none, RS256→HS256 confusion with a reachable public key, weak HMAC secret brute (web-auth-jwt). Homegrown base64/hex cookies → decode, flip the role field, handle the MAC with crypto-oracle-attacks.
5. SSRF, the CTF shape. Any URL fetcher (webhook tester, PDF renderer, image proxy) → http://127.0.0.1/ for internal-only routes, http://169.254.169.254/ only when the Docker setup hints cloud, file:///flag, and gopher:// to hit internal Redis/MySQL (web-ssrf, web-ssrf-gopher-redis-rce). In CTF, the internal service on a weird port is the challenge — scan 127.0.0.1 ports through the SSRF.
6. Chain to the flag. One primitive rarely suffices: LFI → source → secret → signed cookie → admin panel → SSTI → RCE → cat /flag. Treat each confirmed bug as a key that unlocks the next stage (exploit-chaining).

Gotchas

• {{7*7}} rendering as {{7*7}} doesn't rule out SSTI — some challenges only evaluate in error pages, emails, or PDF exports. Try the sink contexts, and try ${7*7}, #{7*7}, <%= 7*7 %> for other engines.
• PHP assert/eval challenges filter obvious words; build strings dynamically ($_GET['x']($_GET['y']) with x=system&y=cat /flag) instead of fighting the blocklist.
• Provided source != deployed source occasionally — verify a behavior against the live app before building an exploit on the reading.
• The flag may need root — RCE as www-data with /flag readable only by root means a second stage: look for setuid binaries, cron, or a SUID flag-reader you must exploit (privesc domain).
• Rate-limited login / captcha in CTF usually hides race conditions (web-race-conditions) or SQLi in the login query, not a brute-force task.

Verify success

The flag string in the correct format, read from the target (file, env, or DB) — not a local reproduction. If you got RCE, id; cat /flag output is the proof.

References

Deep techniques: web-ssti, web-ssrf, web-auth-jwt, web-deserialization, web-lfi-path-traversal, web-python-sandbox-escape, web-command-injection, web-sqli; source-leak hunting: recon-content-discovery, recon-github-code-leaks; token attacks: crypto-oracle-attacks. Triage via ctf-methodology.