Root-Me/CRLF·20ptsCRLF — Root-MeChallenge CRLF on HTTP plumbing and template engines.Webhard#web#root-me#hardMay 26, 2026
Root-Me/API - Mass Assignment·20ptsAPI - Mass Assignment — Root-MeChallenge API - Mass Assignment on HTTP plumbing and template engines.Webhard#web#root-me#hardMay 26, 2026
Root-Me/File upload - Double extensions·20ptsFile upload - Double extensions — Root-MeFor File upload - Double extensions, the backend trusts headers and cookies too much.Webhard#web#root-me#hardMay 26, 2026
Root-Me/HTTP - Directory indexing·15ptsHTTP - Directory indexing — Root-MeServer-side web task HTTP - Directory indexing.Webmedium#web#root-me#mediumMay 26, 2026
Root-Me/Nginx - Alias Misconfiguration·15ptsNginx - Alias Misconfiguration — Root-MeFor Nginx - Alias Misconfiguration, the backend trusts headers and cookies too much.Webmedium#web#root-me#mediumMay 26, 2026
Root-Me/API - Broken Access·15ptsAPI - Broken Access — Root-MeServer-side web task API - Broken Access.Webmedium#web#root-me#mediumMay 26, 2026
Root-Me/HTTP - POST·15ptsHTTP - POST — Root-MeServer-side web task HTTP - POST.Webmedium#web#root-me#mediumMay 26, 2026
Root-Me/Backup file·15ptsBackup file — Root-MeServer-side web task Backup file.Webmedium#web#root-me#mediumMay 26, 2026
Root-Me/HTTP - Open redirect·10ptsHTTP - Open redirect — Root-MeServer-side web task HTTP - Open redirect.Webeasy#web#root-me#easyMay 26, 2026
Root-Me/PHP - Command Injection·10ptsPHP - Command Injection — Root-MeServer-side web task PHP - Command Injection.Webeasy#web#root-me#easyMay 26, 2026
Root-Me/Weak password·10ptsWeak password — Root-MeFor Weak password, the backend trusts headers and cookies too much.Webeasy#web#root-me#easyMay 26, 2026
Root-Me/HTTP - IP restriction bypass·10ptsHTTP - IP restriction bypass — Root-MeFor HTTP - IP restriction bypass, the backend trusts headers and cookies too much.Webeasy#web#root-me#easyMay 26, 2026
Root-Me/HTML - Source code·5ptsHTML - Source code — Root-MeFor HTML - Source code, the backend trusts headers and cookies too much.Webeasy#web#root-me#easyMay 26, 2026