Browse / h1-ctf

h1-ctf

See its reports on the map

Attack surface: 47 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to h1-ctf

• Other weaknesses33
• Access Control20
• Server-Side Request Forgery13
• Information Disclosure11
• SQL Injection8
• Authentication8

Most upvoted reports

AllValidInformativeN/ADuplicate

1. How The Hackers Saved ChristmasInformation Disclosure · critical
   179 votes
2. [H1-415 2020] CTF WriteupServer-Side Request Forgery (SSRF) · critical
   108 votes
3. [h1-415 2020] Spent a week and failed at solving the last step.Improper Access Control - Generic · critical
   99 votes
4. [H1-2006 2020] I successfully solved it!critical
   64 votes
5. [h1-415 2020] Multiple vulnerabilities leading to leaking of secret user filesServer-Side Request Forgery (SSRF) · critical
   56 votes
6. 12 Days of Hacky Holidays write-up, but as a text-based RPG?Uncontrolled Resource Consumption
   44 votes
7. [H1-2006 2020] Connecting the dots to send hackers their Bug BountyCode Injection · critical
   30 votes
8. [H1-2006 2020] I made the CEO's bounty payment!Business Logic Errors · critical
   28 votes
9. H1-CTF 100k Solution - Congratz on the 100k Rep todayisnewSQL Injection · critical
   25 votes
10. [H1-2006 2020] Bypassing access control checks by modifying the URL, internal application state, or the HTML page, or using a custom API attack toolPrivilege Escalation · critical
    23 votes
11. [H1-2006 2020] H1-2006 CTF WriteupInformation Disclosure · critical
    23 votes
12. Saving Christmas from Grinchy GodsSQL Injection · critical
    20 votes
13. [h1-415 2020] I got the flagImproper Access Control - Generic · critical
    20 votes
14. [h1-415 2020] I found Joberts missing file!Violation of Secure Design Principles
    19 votes
15. [H1-2006 2020] Flag for H1-CTF
    18 votes
16. [h1-415 2020] Multiple chained vulnerabilities lead to leaking secret documentInformation Disclosure · critical
    18 votes
17. HackerOne’s 100K CTF WriteupXML External Entities (XXE) · critical
    17 votes
18. [h1-415 2020] h1ctf{y3s_1m_c0sm1c_n0w}Improper Access Control - Generic · critical
    17 votes
19. [h1-415 2020] H1-415 CTF Writeup by W--Security Through Obscurity · critical
    17 votes
20. CCC H1 June 2021 CTF WriteupXML External Entities (XXE) · critical
    16 votes
21. [H1-2006 2020] [Multiple Vulnerability] CTF Writeup - @abdilahrf_critical
    16 votes
22. [h1-415 2020] My writeup on how to retrieve the special secret documentImproper Authentication - Generic · critical
    16 votes
23. 100K CTF's WriteupSQL Injection · critical
    15 votes
24. Solution for hackyholiday
    $50015 votes
25. Adam and the Deadly InjectionsOut-of-bounds Read · critical
    13 votes
26. ccc ctf SQL Injection · critical
    $10013 votes
27. [100K-ctf] Multiple vulnerabilities leading to compromise of Pinger instance.
    13 votes
28. [H1-2006 2020] 36 hours of brain cycles utilized on solving a neat puzzle
    13 votes
29. [H1-2006 2020] CTF Writeup!critical
    13 votes
30. [H1-2006 2020] CTF Writeupcritical
    13 votes
31. [h1-415 2020] Solution for h1415's CTF challenge
    13 votes
32. [h1-2006 2020] Bounty payments are done !Server-Side Request Forgery (SSRF) · critical
    12 votes
33. [h1-415 2020] SSRF in a headless chrome with remote debugging leads to sensible information leakServer-Side Request Forgery (SSRF) · critical
    12 votes
34. [H1-2006 2020] Bounty Pay CTF challengeImproper Access Control - Generic · critical
    11 votes
35. [H1-2006 2020] Multiple vulnerabilities allow to leak sensitive information Improper Access Control - Generic
    11 votes
36. [H1-2006 2020] CTF WriteupServer-Side Request Forgery (SSRF) · critical
    11 votes
37. [h1-415 2020] Chain of vulnerabilities leading to account takeover and unauthorized access of sensitive internal resourcesServer-Side Request Forgery (SSRF) · critical
    11 votes
38. [h1-415 2020] finallyImproper Authentication - Generic · high
    11 votes
39. hackyholidays CTF Writeupcritical
    10 votes
40. Invading Grinch Network and Saving Christmascritical
    10 votes
41. [H1-2006] CTF WriteupImproper Access Control - Generic · critical
    10 votes
42. [H1-2006 2020] CTF Writeup
    10 votes
43. [H1-2006 2020] CTF WriteupServer-Side Request Forgery (SSRF) · critical
    10 votes
44. [H1-2006 2020] Multiple vulnerabilities leading account takeoverPrivilege Escalation · critical
    10 votes
45. A Visit from The Grinch ~ 'Twas the night before Hackmas...Improper Access Control - Generic · critical
    9 votes
46. [h1-ctf] 12 Days of Adventure to stop Grinch from ruining Christmas
    9 votes
47. Flags for hackyholidays CTF
    9 votes
48. Stopping Grinch to ruin XMas!
    9 votes
49. [H1-2006 2020] From multiple vulnerabilities to complete ATO on any customer account and staff adminViolation of Secure Design Principles · critical
    9 votes
50. The Return of the GrinchInformation Disclosure · critical
    8 votes
51. [H1-2006 2020] CTF write-upPrivilege Escalation · critical
    8 votes
52. Hackyholidays [ h1-ctf] writeup [mission:- stop the grinch ]Improper Access Control - Generic · critical
    7 votes
53. Taking Grinch Down To Save HolidaysSQL Injection · critical
    7 votes
54. [h1-2006 2020] CTF WalkthroughServer-Side Request Forgery (SSRF) · critical
    7 votes
55. [h1-2006 2020] Write up for H1-2006 CTFcritical
    7 votes
56. [h1-415 2020] @_bayotop h1-415-ctf writeupPrivilege Escalation · critical
    7 votes
57. ccc.h1ctf.com CTFSQL Injection · critical
    6 votes
58. h1-ctf : 12 days of hack holiday writeupInformation Disclosure · critical
    6 votes
59. [ Hacky Holidays CTF ] Completely taken down the Grinch NetworksServer-Side Request Forgery (SSRF) · critical
    6 votes
60. @shakedko H1-2006 CTF writeupcritical
    6 votes
61. [H1-2006 2020] "Swiss Cheese" design style leads to helping Mårten Mickos pay poor hackersExecution with Unnecessary Privileges
    6 votes
62. CTF WriteupSQL Injection · critical
    5 votes
63. [H1-2006 2020] WriteupImproper Access Control - Generic
    5 votes
64. h1-ctf writeup , finally paid the payments by chaining multiple bugsInformation Disclosure · critical
    5 votes
65. [H1-2006 2020] CTFViolation of Secure Design Principles · critical
    5 votes
66. Grinchs website takendown with various other exploitsImproper Restriction of Authentication Attempts · critical
    4 votes
67. Hacky Holidays CTF WriteupServer-Side Request Forgery (SSRF) · critical
    4 votes
68. [CTF] I've DDoSed Grinch NetworkUncontrolled Resource Consumption · critical
    4 votes
69. ctf walkthroughInformation Disclosure
    4 votes
70. [h1-2006 CTF] Multiple vulnerabilities leading to account takeover and two-factor authentication bypass allows to send pending bounty paymentsImproper Authentication - Generic · critical
    4 votes
71. [h1-2006 2020] Chained vulnerabilities lead to account takeoverInsecure Storage of Sensitive Information · critical
    4 votes
72. [H1-2006 2020] Exploiting multiple vulnerabilities to get hacker's payment ensuredImproper Privilege Management · critical
    4 votes
73. [H1-2006 2020] In-depth resolution of the h1-2006 CTFImproper Access Control - Generic · critical
    4 votes
74. [h1-2006 CTF] Payments for May have been processed!Information Disclosure · critical
    4 votes
75. [H1-2006 2020] CTF writeup
    4 votes
76. [H1-2006 2020] CTF write-upServer-Side Request Forgery (SSRF) · critical
    4 votes
77. [H1-2006 2020] Multiple vulnerabilities lead to CEO account takeover and paid bountiesImproper Authentication - Generic · critical
    4 votes
78. [H1-2006 2020] ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$critical
    4 votes
79. Grinch-Networks taken down - hacky holidays CTF Improper Restriction of Authentication Attempts · critical
    3 votes
80. 12 Days of CTF WalkthroughsServer-Side Request Forgery (SSRF) · critical
    3 votes
81. Grinch Networks compromised!critical
    3 votes
82. h1 hacky holidays CTF solutionBuffer Over-read · critical
    3 votes
83. [H1-2006 2020] Includes 1 free content discoveryImproper Restriction of Authentication Attempts · critical
    3 votes
84. [H1-2006 2020] CTF Writeupcritical
    3 votes
85. [H1-2006 2020] [CTF Writeup] A story about Bounty Payments, Collaboration & CommunityPrivilege Escalation · critical
    3 votes
86. [H1-2006 2020] Solution for the h1-2006 CTF challengePrivilege Escalation · high
    3 votes
87. [H1-2006 2020] The Story of Making Bounty Hunters HappyImproper Access Control - Generic
    3 votes
88. [H1-2006 2020] H1-CTF writeup
    3 votes
89. H1 Hackyholidays CTF - The Grinch was defeatedcritical
    2 votes
90. [h1ctf-Grinch Networks] MrR3b00t Saving the Christmascritical
    2 votes
91. Mission completed. Grinch Networks is down and Christmas saved.Uncontrolled Resource Consumption · critical
    2 votes
92. Complete destruction of the Grinch serverBusiness Logic Errors · high
    2 votes
93. Hackyholidays CTF writeupImproper Restriction of Authentication Attempts
    2 votes
94. [h1-2006 2020] Writeup h12006 CTFPrivilege Escalation · high
    2 votes
95. [H1-2006 2020] How I solved my first H1 CTFViolation of Secure Design Principles · critical
    2 votes
96. It's just a man on a missioncritical
    1 votes
97. Infiltrating into Grinch-Networks and saving Christmas!Server-Side Request Forgery (SSRF) · critical
    1 votes
98. HackyHolidays H1 CTF Writeup
    1 votes
99. Writeup Submissionhigh
    1 votes
100. HackyHolidays 2020 Full Write-up: Information Disclosure of 12 FlagsInformation Disclosure · critical
     1 votes