Challenges

17 flags. Each one is very easy: the clue tells you almost exactly where to look. You need a browser, View Source, DevTools, and maybe curl or Burp.

1. Read the Source10 pts

   Developers leave notes. Press Ctrl+U on the home page.

2. Robots Know Things10 pts

   Every site tells crawlers where not to go. Which file is that?

3. Talking Headers10 pts

   Look at the HTTP response headers (DevTools → Network, or curl -I). Note the server banners too.

4. Leaky .env20 pts

   Framework config files sometimes sit in the web root. Try the classic dotfile.

5. Git Exposed20 pts

   Someone deployed with the repository folder. Its config may hold credentials.

6. Forgotten Backup20 pts

   robots.txt mentioned a backup folder. Is directory listing on?

7. API Docs in the Open20 pts

   APIs usually ship docs. Find them (robots.txt helps) and the OpenAPI JSON.

8. No Auth on the API30 pts

   The API docs list a users endpoint marked "TODO: add auth". Read every field.

9. Change the Number (IDOR)30 pts

   Sign in as the student and open a deal on the pipeline. Watch the request in DevTools (or check /api/v1/my-deals), then open a deal you don't own. Deal IDs start at 1001.

10. Keys in JavaScript30 pts

    Read /static/js/app.js. A key is hardcoded. Send it as an X-API-KEY header to the internal config API.

11. Root API30 pts

    "No auth because it's behind the firewall." The docs list a /api/root family. Get the system secrets.

12. Debug in Production20 pts

    A debug endpoint is listed in robots.txt. Debug output loves to print environment variables.

13. SQLi Login Bypass40 pts

    Log in without a password. Hint: ' OR '1'='1' -- in the username. The page even shows you the query.

14. UNION SELECT50 pts

    The industry filter on the Customers page is injectable and returns 4 columns. List tables via sqlite_master, then read the flag table.

15. Cookie Monster40 pts

    Log in as student and look at the kavis_session cookie. It is just Base64 JSON. Become admin and visit /admin.

16. Reflected XSS30 pts

    The Help centre search prints your query back without escaping. Make it run JavaScript (e.g. an <img src=x onerror=alert(1)>).

17. Dot Dot Slash40 pts

    The product datasheet download (see /sitemap.xml) takes a filename. Climb out of downloads/: the flag is in secret/flag.txt one level up. Bonus: read /etc/passwd.

Report tip: for each flag, record the URL, the request, why it is a vulnerability and how to fix it. That is what a real bug bounty report needs.