Web Application Hacking.
Challenges
Multiple Choice
Which language runs in your browser to make a web page interactive (e.g., responding to button clicks)?
It is one of the three core front-end technologies, alongside HTML and CSS.
✓ Solved!
Multiple Choice
On the front end, what is HTML primarily responsible for?
CSS handles styling and JavaScript handles behavior — this one handles the page itself.
✓ Solved!
Multiple Choice
Where does back-end code typically run?
The back end runs somewhere the user cannot directly see or modify.
✓ Solved!
Multiple Choice
When a website needs to store and retrieve information like user accounts, what does the back end usually talk to?
It is where persistent data lives, often queried with a language like SQL.
✓ Solved!
Multiple Choice
A page inserts user input directly into the DOM with element.innerHTML. An attacker submits <img src=x onerror=alert(1)>. What class of vulnerability does this enable?
Untrusted input is being executed as code in the victim's browser.
✓ Solved!
Multiple Choice
Why is client-side JavaScript validation alone insufficient for security (e.g., enforcing a price or hiding an admin check in the browser)?
Anything that runs in the browser is fully under the user's control — security must be enforced server-side.
✓ Solved!
Flag Challenge
Web servers often host files that are not linked anywhere on the site but are still publicly accessible. This well-known file tells search engine crawlers where they can and cannot go. Find it on this site and submit the flag hidden inside.
Try researching well-known files — it is a standard file at the root of most websites.
✓ Solved!
Flag Challenge
Most web pages send code to your browser to run, and you can inspect everything it does. This page runs some JavaScript that leaves a message behind the scenes. What secret does the JS have for you?
Press F12 (or right-click → Inspect) and explore the tools.
✓ Solved!
Flag Challenge
The JavaScript that is responsible for the last flag has some extra fun. Read the source and recover the password that unlocks the flag. What PASSWORD (not flag) should be used to expose the flag?
checkPassword() compares each character's code against a fixed list. Convert those character codes back to text to get the password (then you can call getFlag("...") in the console to see the flag it unlocks).
✓ Solved!
Flag Challenge
This page loads a user profile from a JSON API. There is a special user that may have something special for you... Go get the secret flag from that user profile!
In the challenge JS file, there is some logic to start personalizing the page. But, it seems to be a bit flawed with a common vulnerability called IDOR (Insecure Direct Object Reference).
✓ Solved!
For More Information
PortSwigger
PortSwigger provides a variety of resources for learning about web application security. The Web Security Academy is a great place to start for learning about web security and the various vulnerabilities that can be found in web applications. The Burp Suite is a great tool also released by PortSwigger used for testing web applications.
Visit →OWASP
OWASP maintains various projects related to web application security. The OWASP Top 10 is a great place to start for learning about the most common vulnerabilities found in web applications. The OWASP Juice Shop is a vulnerable web application that can be used to practice finding and exploiting vulnerabilities.
Visit →