# Challenges

Maze

Navigate through a series of mazes. Speed and precision are key.

Cursed Math

Cursed math equations hidden behind strange characters. Can you keep up?

Mind Mapping

A web-based calculator and data transformer. Multiple operations are available — which ones can you abuse?

Math Challenge

Log Poisoning

An Apache web server with a curious search feature.

Librarian 9

The most heavily guarded library yet. HTML encoding locks down almost everything. Almost.

Librarian 8

Regex-based filtering protects the librarian. But regex has its edge cases.

Librarian 7

A different kind of library — this one uses Python. The form input is rendered in a way that reveals more than intended.

Librarian 6

Protocol-based restrictions guard the library. But the conditional logic has a gap.

Librarian 5

URL-encoded paths go through a decoding step before validation. Does the order of operations matter?

Librarian 4

The librarian strips dangerous keywords from your request. But does it strip them thoroughly enough?

Librarian 3

The library system supports multiple protocols for reading files. Some of them are more powerful than others.

Librarian 2

The librarian learned to block certain characters. Can you still convince it to read forbidden texts?

Librarian 1

The librarian fetches books by name. What else can you ask it to read?

Inca Empire

The Inca Empire web portal renders user input in unexpected ways. What if the template engine processes more than it should?

HTTP

Not everything is visible on the surface. Look closer at how the server responds.

Hangman

A classic game of Hangman. The word might be simpler than you think.

Forbidden 1

Access denied. The admin page is off limits.

Executioner 3

The final executioner. Almost everything useful is blocked. Almost.

Executioner 2

The executioner returns with tighter restrictions. Spaces and slashes are no longer your friends.