web

We Love The Environment

We do *not*, however, love challenges with names like nlinephp

Art Contest

Visit this website and submit your best ASCII art for a chance to become the 2023 ASCII Art Contest Winner. This year, everything will be graded by our automated grader. Winner gets a flag!

Gotion

Gotion is yet another simple secure note service. You might have seen these kind of applications many times before, but try this one!

RacCoin

Why sweat when you can pay to win? 😉 Don't worry, your purchases are completely anonymous because RacCoin (RCN) uses blockchain! RCN is completely open-source, so you know we are secure

xark

Guest challenge by Alok Menghrajani. http://chals.2022.squarectf.com:4105

Star Cereal

The Star Cereal has returned! This time with impenetrable security. You're never getting my cereal! http://starcereal.chall.seetf.sg:10004 MD5: 7c990f8e301da8cdf544af595ce62e24

NotHandSanitizer™

APOCALYPSE has recently implemented a security feature called NotHandSanitizer™ to secure their member login portal. We heard that there's a flag somewhere in their database, but we can't seem to find a working attack vector since SQL Injections seem impossible due to NotHandSanitizer™. Perhaps you could take a look for us?

Meoware

SpaceY Corp. has been hit by a meoware attack. Wait a second, what even is a meoware? Nevertheless, your job here is simple. Retrieve the stolen flag from their web servers before they vanish for good.

X marks Louis's treasure

Finding a web page that leads to Louis' hidden treasure on his server HEHEHEHE [chals.whitehacks.ctf.sg:50101](http://chals.whitehacks.ctf.sg:50101/)

WAF Bypass

Can you get flag from the environment? [chals.whitehacks.ctf.sg:50401](http://chals.whitehacks.ctf.sg:50401/)

BabyPHP

John is trying to juggle between learning PHP and his other homework. Fortunately, he managed to complete his PHP task - creating a simple web login. He challenges you to find a way to bypass his login. Take a look at his PHP masterpiece now! [chals.whitehacks.ctf.sg:50201](http://chals.whitehacks.ctf.sg:50201/)

Magic

Can you find the trick?

JSON

We have found an internal system that is externally exposed. Retrieve the Flag from this system.

Check URL

Have you ever used curl?

Can't use DB

Can't use DB. I have so little money that I can't even buy the ingredients for ramen. 🍜

Login portal

During our investigations, we 've manage to find the [login portal](http://aiodmb3uswokssp2pp7eum8qwcsdf52r.ctf.sg:50201/) for APOCALYSE members. Seems like all you have to do is login to get the flag, but it seems to be pretty damn secure since they actually filter user input and use password hashes. :(

Secret base 3

Secret base 2

Secret base 1

APOCALYPSE hired an administrator improve the physical security of their secret base. Your task is to gain access to the physical security device. The flag for this challenge is similar to 15{h...e} (starts with 'h' and ends with 'e').

Secure Flag Distribution Service

We've recently discovered that APOCALYPSE is running an illegal [flag distribution service](http://aiodmb3uswokssp2pp7eum8qwcsdf52r.ctf.sg:50401/) to share flags among all their agents. Can you infiltrate their system and take a look? Seems like they're using some OTP system to ensure that only their members can login.

phpme

Completely secure publishing