Welcome to WAPT challenges

WAPT challenges constitutes a collection of challenges sorted by difficulty for practicing your skills in web application testing and cybersecurity in general.

Basic challenges [top]

1. challenge1 (the agent)
   to complete this challenge you must use the CyberSecBrowser agent.
2. challenge2 (the role)
   to complete this challenge you must be a super user.
3. challenge3 (the magic number)
   to complete this challenge you must guess the magic number.
4. challenge4 (the magic number 2)
   to complete this challenge you must guess the magic number, which is a number between 1 and 499.
5. challenge5 (the secret)
   to complete this challenge you must find the secret password.
6. challenge6 (the .s3cret)
   to solve this challenge you need to read the content of a secret file (named .s3cret).
7. challenge7 (the .s3cret config)
   to solve this challenge you need to read the content of a secret configuration file (named .s3cret) contained in the private directory.
8. challenge8 (the hidden file)
   to complete this challenge you need to find a hidden file contained in this directory. Can you read its content?
9. challenge9 (the hidden file 2)
   to complete this challenge you need to find a hidden file contained in this directory. Can you read its content?
10. challenge10 (the right IP)
    to complete this challenge you need to trick the application into thinking you are connecting from 192.168.1.X.
11. challenge11 (the open redirect)
    to complete this challenge you must trick the application by making a redirect to https://www.wikipedia.org.
12. challenge12 (the open redirect 2)
    to complete this challenge you must trick the application by making a redirect to https://www.wikipedia.org.
13. challenge13 (the crawler)
    to complete this challenge you have to find an hidden .s3cret file
14. challenge14 (credentials)
    to complete this challenge you must guess username and password
15. challenge15 (the agent 2)
    to complete this challenge you must guess the correct user agent.
16. challenge16 (the backup)
    to complete this challenge you need to find a backup file that someone forgot to delete before deploying to production.
17. challenge17 (the git leak)
    to complete this challenge you need to find a version control directory that should never have been deployed here.

Advanced challenges [top]

1. challenge1 (the logger)
   to complete this challenge you must manage to call the PHP function success().
2. challenge2 (credentials)
   to complete this challenge you must guess username and password