websec.fr
Exploit small vulnerable web apps with their source code to capture flags
websec.fr is a long-running web security wargame. Each level is a small vulnerable web application with a short description and a link to its source code. You read the code, find the flaw, exploit it and submit a flag of the form WEBSEC{...}.
Free · No login · Browser · Intermediate
About websec.fr
The 31 levels are grouped as babysteps, easy, medium, hard and bonus, and carry 0 to 4 points each. Most lean on PHP, and one bonus level notes that PHP is not the only language. It trains careful code reading and classic web bugs such as injection.
It is free. An account is optional and only needed for the scoreboard. Players help each other on IRC, and the rules ask you not to publish detailed writeups.
On Breakpoint since 28 Oct 2026.
Made this game? Claim it →
Tips and discussion
No tips yet.
Sign in to share a tip.