CTF CHALLENGE · web · Hard · 1000 pts

Clicko — Flight Booking

A full flight-booking platform with a PHP API and admin panel, built as a deliberately-vulnerable practice target. Work through the storefront and its API, find and exploit the OWASP Top 10 flaws, and capture every flag to fully compromise the application. Each flag is one attack vector — submit them in any order.

Objectives

• ["Map the storefront
• its API and the admin panel"
• "Find one flaw per flag (8 flags total)"
• "Chain the flaws to reach administrative control"]

Enter the CTF arena →