Sign in Sign up

Writeups

321 results

Root-Me/CRLF·20pts

CRLF — Root-Me

Challenge CRLF on HTTP plumbing and template engines.

Webhard#web #root-me #hardMay 26, 2026

Root-Me/API - Mass Assignment·20pts

API - Mass Assignment — Root-Me

Challenge API - Mass Assignment on HTTP plumbing and template engines.

Webhard#web #root-me #hardMay 26, 2026

Root-Me/File upload - Double extensions·20pts

File upload - Double extensions — Root-Me

For File upload - Double extensions, the backend trusts headers and cookies too much.

Webhard#web #root-me #hardMay 26, 2026

Root-Me/HTTP - Directory indexing·15pts

HTTP - Directory indexing — Root-Me

Server-side web task HTTP - Directory indexing.

Webmedium#web #root-me #mediumMay 26, 2026

Root-Me/Nginx - Alias Misconfiguration·15pts

Nginx - Alias Misconfiguration — Root-Me

For Nginx - Alias Misconfiguration, the backend trusts headers and cookies too much.

Webmedium#web #root-me #mediumMay 26, 2026

Root-Me/API - Broken Access·15pts

API - Broken Access — Root-Me

Server-side web task API - Broken Access.

Webmedium#web #root-me #mediumMay 26, 2026

Root-Me/HTTP - POST·15pts

HTTP - POST — Root-Me

Server-side web task HTTP - POST.

Webmedium#web #root-me #mediumMay 26, 2026

Root-Me/Backup file·15pts

Backup file — Root-Me

Server-side web task Backup file.

Webmedium#web #root-me #mediumMay 26, 2026

Root-Me/HTTP - Open redirect·10pts

HTTP - Open redirect — Root-Me

Server-side web task HTTP - Open redirect.

Webeasy#web #root-me #easyMay 26, 2026

Root-Me/PHP - Command Injection·10pts

PHP - Command Injection — Root-Me

Server-side web task PHP - Command Injection.

Webeasy#web #root-me #easyMay 26, 2026

Root-Me/Weak password·10pts

Weak password — Root-Me

For Weak password, the backend trusts headers and cookies too much.

Webeasy#web #root-me #easyMay 26, 2026

Root-Me/HTTP - IP restriction bypass·10pts

HTTP - IP restriction bypass — Root-Me

For HTTP - IP restriction bypass, the backend trusts headers and cookies too much.

Webeasy#web #root-me #easyMay 26, 2026

Root-Me/HTML - Source code·5pts

HTML - Source code — Root-Me

For HTML - Source code, the backend trusts headers and cookies too much.

Webeasy#web #root-me #easyMay 26, 2026

Root-Me/XSS DOM Based - Introduction·35pts

XSS DOM Based - Introduction — Root-Me

Web client notes for XSS DOM Based - Introduction: XSS variants, CSP bypass narratives, and chaining a UI flaw with an API call the server should have rejected..

Webinsane#web #root-me #insaneMay 26, 2026

Root-Me/CSRF 0 protection·35pts

CSRF 0 protection — Root-Me

Client-side web challenge CSRF 0 protection.

Webinsane#web #root-me #insaneMay 26, 2026

Root-Me/CSP Bypass - Inline code·35pts

CSP Bypass - Inline code — Root-Me

For CSP Bypass - Inline code, the attack surface lives in front-end validation.

Webinsane#web #root-me #insaneMay 26, 2026

Root-Me/AST - Deobfuscation·35pts

AST - Deobfuscation — Root-Me

Client-side web challenge AST - Deobfuscation.

Webinsane#web #root-me #insaneMay 26, 2026

Root-Me/XSS - Stored 1·30pts

XSS - Stored 1 — Root-Me

Web client notes for XSS - Stored 1: XSS variants, CSP bypass narratives, and chaining a UI flaw with an API call the server should have rejected..

Webhard#web #root-me #hardMay 26, 2026

Root-Me/Javascript - Obfuscation 3·30pts

Javascript - Obfuscation 3 — Root-Me

Client-side web challenge Javascript - Obfuscation 3.

Webhard#web #root-me #hardMay 26, 2026

Root-Me/Javascript - Webpack·15pts

Javascript - Webpack — Root-Me

For Javascript - Webpack, the attack surface lives in front-end validation.

Webmedium#web #root-me #mediumMay 26, 2026