Skip to content
  1. registration
  2. live
  3. resultsnow

Targets

Challenges

9 challenges across 1 vulnerable app, each tagged with its OWASP Top 10 category. Points scale with difficulty. Patch the regression test tied to each challenge to score it.

Scores land within about a minute of your pull request’s checks finishing — your patched marks here and on your profile update on reload. A run that finished but scored nothing means the regression test still fails: open your PR’s Checks tab on GitHub to see which test, fix, and push again. Your best result always stands.

9 shown
owasp-ctf-test/VAmPI
  • Excessive Data Exposure via Debug Endpoint1 ptAPI3
  • User and Password Enumeration1 ptAPI2
  • SQL Injection in Username Lookup2 ptsAPI1
  • Mass Assignment Privilege Escalation1 ptAPI6
  • Broken Object Level Authorization on Books2 ptsAPI1
  • Unauthorized Password Change2 ptsAPI1
  • Weak JWT Signing Key3 ptsAPI2
  • Regular Expression Denial of Service3 ptsAPI4
  • Lack of Rate Limiting1 ptAPI4