Web - Server

Server-side web flaws: injection, SSRF, auth bypass, and backend exploitation.

13 results

Root-Me/CRLF·20pts

CRLF — Root-Me

Challenge CRLF on HTTP plumbing and template engines.

Webhard#web #root-me #hardMay 26, 2026

Root-Me/API - Mass Assignment·20pts

API - Mass Assignment — Root-Me

Challenge API - Mass Assignment on HTTP plumbing and template engines.

Webhard#web #root-me #hardMay 26, 2026

Root-Me/File upload - Double extensions·20pts

File upload - Double extensions — Root-Me

For File upload - Double extensions, the backend trusts headers and cookies too much.

Webhard#web #root-me #hardMay 26, 2026

Root-Me/HTTP - Directory indexing·15pts

HTTP - Directory indexing — Root-Me

Server-side web task HTTP - Directory indexing.

Webmedium#web #root-me #mediumMay 26, 2026

Root-Me/Nginx - Alias Misconfiguration·15pts

Nginx - Alias Misconfiguration — Root-Me

For Nginx - Alias Misconfiguration, the backend trusts headers and cookies too much.

Webmedium#web #root-me #mediumMay 26, 2026

Root-Me/API - Broken Access·15pts

API - Broken Access — Root-Me

Server-side web task API - Broken Access.

Webmedium#web #root-me #mediumMay 26, 2026

Root-Me/HTTP - POST·15pts

HTTP - POST — Root-Me

Server-side web task HTTP - POST.

Webmedium#web #root-me #mediumMay 26, 2026

Root-Me/Backup file·15pts

Backup file — Root-Me

Server-side web task Backup file.

Webmedium#web #root-me #mediumMay 26, 2026

Root-Me/HTTP - Open redirect·10pts

HTTP - Open redirect — Root-Me

Server-side web task HTTP - Open redirect.

Webeasy#web #root-me #easyMay 26, 2026

Root-Me/PHP - Command Injection·10pts

PHP - Command Injection — Root-Me

Server-side web task PHP - Command Injection.

Webeasy#web #root-me #easyMay 26, 2026

Root-Me/Weak password·10pts

Weak password — Root-Me

For Weak password, the backend trusts headers and cookies too much.

Webeasy#web #root-me #easyMay 26, 2026

Root-Me/HTTP - IP restriction bypass·10pts

HTTP - IP restriction bypass — Root-Me

For HTTP - IP restriction bypass, the backend trusts headers and cookies too much.

Webeasy#web #root-me #easyMay 26, 2026

Root-Me/HTML - Source code·5pts

HTML - Source code — Root-Me

For HTML - Source code, the backend trusts headers and cookies too much.

Webeasy#web #root-me #easyMay 26, 2026