Where real vulnerabilities
become challenges.

Every scenario here is modeled on an actual bug class — chained exploits, business logic flaws, and the mistakes real engineers ship to production. No toy puzzles built just to fit a category.

Start hacking →See how it works

$ curl -F file=@evil.svg target/upload

→ 200 OK, stored at /cache/evil.svg

$ convert evil.svg out.png

→ delegate executed on the server

$ cat /flag.txt

RWCTF{...}

[✓] scenario solved

Scenarios

1,240+

Community solves

Active hunters

Why hunters practice here

Built to feel like a real engagement

Chained, not scripted

Every scenario stitches together several small mistakes, the way real incidents do — no single silver-bullet payload.

Live scoreboard

Points, ranks, and solve counts update the moment a flag lands, so you always know where you stand.

Built for understanding

Difficulty badges and hint-free descriptions push you to actually understand the bug, not pattern-match a writeup.

Your next bug started with someone's late-night mistake.

Find it first.