A deliberately vulnerable PHP and MySQL web application with a Chinese interface covering brute force, XSS (with an XSS back end), CSRF, SQL injection, RCE, file inclusion, unsafe upload and download, directory traversal, XXE, SSRF, unsafe deserialization and more, one page per variant.
Not startedDockercommit 83a258ax86_64 · aarch64Secret
One-shot by default: solve each challenge from its prompt alone.
Opening guided steps or hints is recorded. A solve without them counts as stronger evidence for your skills.
Use Pikachu's RCE section to run a command on the web server and read /ctf/flag.
The brief for this lab lives in its repository.