I made a cool website where you can announce whatever you want! I read about input sanitization, so now I remove any kind of characters that could be a problem :)Additional details will be available after launching your challenge instance.
May 18, 2025
I made a cool website where you can announce whatever you want! Try it out!Additional details will be available after launching your challenge instance.
May 18, 2025
The login system has been upgraded with a basic rate-limiting mechanism that locks out repeated failed attempts from the same source. We’ve received a tip that the system might still trust user-controlled headers. Your objective is to bypass the rate-limiting restriction and log in using the known email address: ctf-player@picoctf.org and uncover the hidden secret.Additional details will be available after launching your challenge instance.
May 18, 2025
We’re in the middle of an investigation. One of our persons of interest, ctf player, is believed to be hiding sensitive data inside a restricted web portal. We’ve uncovered the email address he uses to log in: ctf-player@picoctf.org. Unfortunately, we don’t know the password, and the usual guessing techniques haven’t worked. But something feels off... it’s almost like the developer left a secret way in. Can you figure it out?
May 18, 2025
A university's online registration portal asks students to upload their ID cards for verification. The developer put some filters in place to ensure only image files are uploaded but are they enough? Take a look at how the upload is implemented. Maybe there's a way to slip past the checks and interact with the server in ways you shouldn't.
May 18, 2025
April 27, 2025
April 27, 2025
April 27, 2025
April 27, 2025
April 27, 2025
April 27, 2025
April 27, 2025
April 27, 2025
April 27, 2025
March 13, 2025
March 13, 2025
March 12, 2025
March 12, 2025
March 12, 2025
ABC Bank's website has a loan calculator to help its clients calculate the amount they pay if they take a loan from the bank. Unfortunately, they are using an eval function to calculate the loan. Bypassing this will give you Remote Code Execution (RCE). Can you exploit the bank's calculator and read the flag?
