Catalogue & déploiement

AG — Broken Access Control

AG — Broken Access Control

AG — Brute Force

AG — Buffer Overflow

AG — Business Logic

AG — Cache Poisoning

AG — Clickjacking

AG — Command Injection

AG — CORS

AG — Crypto Failures

AG — Crypto Failures

AG — CSRF

AG — Deserialization

AG — Easy Letter

AG — File Upload

AG — HPP

AG — IDOR

AG — IDOR

AG — Info Disclosure

AG — Injection

AG — Injection

AG — Insecure Design

AG — Integrity Failures

AG — JWT Misuse

AG — Kill Chain Ridex

AG — Known Vulns

AG — LFI

AG — Logging Failures

AG — NoSQL Injection

AG — Path Traversal

AG — Path Traversal

AG — Prototype Pollution

AG — Race Conditions

AG — RFI

AG — Security Misconfiguration

AG — Security Misconfiguration 2

AG — SQL Injection

AG — SSRF

AG — SSRF

AG — SSTI

AG — Vulnerable Components

AG — Web Fuzzing

AG — Web Hack 01

AG — Web Hack 02

AG — Web Hack 04

AG — Web Hack 05

AG — XSS

AG — XSS DOM

AG — XSS Reflected

AG — XSS Stored

AG — XXE

AuthForge - Hash Length Extension Attack

Brute Force

CorpDirectory - LDAP Injection

Cross-Site Scripting

DataStream - Node.js Deserialization RCE

DevHub - GraphQL Introspection + IDOR

DevPulse - Git Exposure + JWT Forgery

DocReader — Technical Documentation Portal (CTF Challenge)

HelpDesk Pro - Mass Assignment + Privilege Escalation

IDOR — Accès Fantôme

Injection

InternalBoundary.io - CTF Challenge

Kill Chain — Ridex Corp

Kill Chain — Travely

LearnQuest - Path Traversal + Pickle Deserialization

MedixCare - LFI + Log Poisoning

NetWatch - Command Injection + File Read

Opération PHANTOM-01

Opération PHANTOM-02

Opération PHANTOM-04

Opération PHANTOM-05

Path Traversal

PhotoScan Pro - Command Injection

SoundWave - JWT KID Injection + SQLi

SPECTRA OPS - JWT Algorithm Confusion (RS256 → HS256)

Taskr.io - IDOR + Mass Assignment

Vulnerable Server

Wanderlust - CRLF Injection + Session Hijack

Web Fuzzing

Westbrook University - Open Redirect + Phishing

ArtGallery - File Upload Webshell

AST Reversing CTF Challenge

Authentication Failures

Broken Access Control

Buffer Overflow & Use-After-Free

Business Logic Flaws

CipherGuard - Timing Attack (Side Channel Oracle)

Clickjacking

ConfigMerge — Configuration Management API

CORS Misconfiguration

Cryptographic Failures

CSRF

DevTrack — CTF Challenge (GraphQL Introspection & IDOR)

DocVault - Zip Slip Path Traversal

File Inclusion — LFI

File Inclusion — RFI

File Upload Vulnerabilities

GraphQL — Level 1

HRConnect — Human Resources Management Platform

HTTP Parameter Pollution

http://challenge99.howhackthis.com:8067/files/..%2Fserver.js

IDOR

Information Disclosure

Insecure Deserialization

Known Vulnerable Components

LegacyShop — CTF Challenge | PHP assert() Injection (RCE)

LiveChat — Real-time Team Messaging Platform

LLM 01 security

Mishandling of Exceptional Conditions

NexusAuth — CTF Challenge | Header Interception via Redirect Chain

NoSQL Injection

OAuth / JWT Misuse

OS Command Injection

OWASP Software or Data Integrity Failures

Path Traversal

PixelVault — CTF Challenge | File Upload + PHP Code Injection

Prototype Pollution JS

Race Conditions

ReportBuilder — Enterprise Document Generator

Security Misconfiguration

Server-Side Template Injection

SQL Injection

SSRF

TokenForge - PRNG Prediction

TrackHub - CRLF Injection / HTTP Header Splitting

VaultPay — Digital Wallet & Rewards

Web Cache Poisoning

XSS — DOM Based

XSS — Reflected

XSS — Stored

XXE Injection

zca-antigravity-february-2026-webhack03

🕵️‍♂️ Web Recon Challenge – Dockerized OSINT

AuthHub — Single Sign-On Identity Provider (CTF Challenge)

CacheEdge — CDN & Cache Management Portal

CalcEngine - Node.js Eval/Code Injection

CloudLink - SSRF avec DNS Rebinding

CrossVault — Secure API Gateway (CTF Challenge)

DataForge - Python Pickle Deserialization RCE

DataQuery — GraphQL API Explorer (CTF Challenge)

DevStack — PHP Development Environment Manager

EnvConfig — .env Exposure via Static Files Misconfiguration

HashVault — Secure Password Recovery Portal

HireFlow - XXE (XML External Entity)

LegacyBank — Online Banking Portal (CTF Challenge)

NovaMart - SSTI Jinja2

NumericAuth — API Gateway Portal

OWASP A01 — Broken Access Control

OWASP A02 — Cryptographic Failures

OWASP A03 — Injection

OWASP A04 — Insecure Design

OWASP A05 — Security Misconfiguration

OWASP A06 — Vulnerable Components

OWASP A07 — Authentication Failures

OWASP A08 — Integrity Failures

OWASP A09 — Logging Failures

OWASP A10 — SSRF

PixelBoard - XSS Stored + CSP Bypass

ProxyGate — Reverse Proxy Management Console

SecureMail - NoSQL Injection

TemplateForge — Dynamic Report Generator

TokenForge — JWT Authentication Service

TrustNet SSO - Open Redirect + Session Fixation Chain

UploadZone — Media Sharing Platform

VaultBank - SQL Injection Blind Time-Based

WikiEdit — Legacy Content Management System

FormulaLab — CTF Challenge | JS vm Sandbox Escape (RCE)

postMessage Abuse

ChatPulse - DOM XSS via postMessage + CSRF

CipherVault - Stego + Zip + Reverse Engineering

ClearanceVault - IDOR + Upload Bypass + RCE

CloudPanel - Session Fixation + IDOR + Command Injection

ConnectHub - GraphQL Introspection + IDOR + SQLi

DigiSafe - Timing Attack + Auth Bypass

EdgeNet CDN - Cache Poisoning + XSS + Session Theft

EncryptChat - ECB Byte-at-a-Time + Auth Bypass + SQLi

FragZone - XSS Stored + CSRF + Privilege Escalation

GraphQL — Level 2

MediVault HMS - SQLi + SSTI + RCE

Meridian Bank - Race Condition + IDOR + SQLi

NexPay - Enumeration + XXE + SSRF + RCE

NoteHive - Prototype Pollution + EJS RCE

QuantLab - Eval Injection + PRNG Prediction + Auth Bypass

ServerWatch - LFI + Log Poisoning + SSTI RCE

TechRecruit - Second-Order SQLi + RCE

VaultChain - NoSQL Injection + JWT Crack + SSRF

JWT Algorithm Confusion

HTTP Request Smuggling

GraphQL — Level 3

EDR Alert — PowerShell [VECTOR-022]

Insider Threat — USB Exfil [MIDNIGHT-021]

Insider Threat — USB Exfil [MIDNIGHT-069]

Insider Threat — USB Exfil [MIDNIGHT-090]

Insider Threat — USB Exfil [RAPID-044]

Insider Threat — USB Exfil [RAPID-072]

Insider Threat — USB Exfil [SILENT-047]

JNDI Scan — Log4Shell-like [FROST-034]

JNDI Scan — Log4Shell-like [RAPID-006]

JNDI Scan — Log4Shell-like [TITAN-009]

Lateral Movement — WMI [MIDNIGHT-029]

Lateral Movement — WMI [MIDNIGHT-051]

Lateral Movement — WMI [SMOKY-073]

Lateral Movement — WMI [TITAN-049]

Lateral Movement — WMI [TITAN-063]

Malware C2 — Beaconing [MIDNIGHT-011]

Malware C2 — Beaconing [MIDNIGHT-076]

Malware C2 — Beaconing [TITAN-058]

Phishing — O365 Credential Harvest [CIPHER-054]

Phishing — O365 Credential Harvest [EMBER-079]

Phishing — O365 Credential Harvest [NOVA-048]

Phishing — O365 Credential Harvest [SILENT-062]

Phishing — O365 Credential Harvest [SMOKY-045]

Phishing — O365 Credential Harvest [TITAN-098]

Proxy Alert — User-Agent Suspect [CIPHER-055]

Proxy Alert — User-Agent Suspect [CIPHER-056]

Proxy Alert — User-Agent Suspect [MIDNIGHT-099]

Proxy Alert — User-Agent Suspect [RAPID-075]

Proxy Alert — User-Agent Suspect [SILENT-071]

Proxy Alert — User-Agent Suspect [VECTOR-019]

Proxy Alert — User-Agent Suspect [VECTOR-042]

Proxy Alert — User-Agent Suspect [VECTOR-081]

Ransomware — Propagation SMB [CIPHER-026]

Ransomware — Propagation SMB [CIPHER-082]

Ransomware — Propagation SMB [EMBER-066]

Ransomware — Propagation SMB [FROST-046]

Ransomware — Propagation SMB [FROST-097]

Ransomware — Propagation SMB [MIDNIGHT-074]

Ransomware — Propagation SMB [SILENT-077]

Ransomware — Propagation SMB [TITAN-018]

Ransomware — Propagation SMB [TITAN-052]

Ransomware — Propagation SMB [TITAN-092]

Ransomware — Propagation SMB [VECTOR-025]

SQL Injection — Analyse de Logs [EMBER-030]

SQL Injection — Analyse de Logs [TITAN-038]

Supply Chain — Package Altéré [CIPHER-008]

Supply Chain — Package Altéré [EMBER-016]

Supply Chain — Package Altéré [SILENT-084]

Supply Chain — Package Altéré [SMOKY-013]

Suspicious Scheduled Task [CIPHER-027]

Suspicious Scheduled Task [CIPHER-028]

Suspicious Scheduled Task [EMBER-007]

Suspicious Scheduled Task [EMBER-085]

Suspicious Scheduled Task [FROST-094]

Suspicious Scheduled Task [TITAN-039]

VPN Compromise — Impossible Travel [CIPHER-037]

VPN Compromise — Impossible Travel [FROST-093]

VPN Compromise — Impossible Travel [MIDNIGHT-095]

VPN Compromise — Impossible Travel [NOVA-070]

VPN Compromise — Impossible Travel [SILENT-003]

VPN Compromise — Impossible Travel [SMOKY-001]

VPN Compromise — Impossible Travel [VECTOR-087]

Webshell — POST Suspect [NOVA-057]

Webshell — POST Suspect [VECTOR-091]

Reverse — Easy Letter

Reverse — Initiation

Reverse — Initiation II

Reverse — Initiation III

Reverse — Malware Analysis

Reverse — Rust Binary

Reverse — XOR Cipher

Reverse — XOR Cipher II

SecureComm - XOR Cipher avec clé courte

AES-ECB — Patterns in the Dark

CTF Challenge: CryptoVault — Secure Data Platform (Cryptographic Failures)

EvidenceVault - Stéganographie LSB dans PNG

Padding Oracle

CoinDash - Race Condition Double Spend

ConfigHub - Prototype Pollution

Stégano — Yellow Point

Stéganographie — Données Enfouies