What is owasp2025-top10-ctf?

This is a collection of 24 web security practice challenges built around the OWASP Top 10:2025, a published list of the most critical types of security vulnerabilities found in web applications. The challenges are designed for CTF (Capture the Flag) competitions, security training, and learning about real attack techniques in a safe, intentionally vulnerable environment. The 24 challenges are organized into 8 security categories, with 3 difficulty levels in each: easy, medium, and hard. The categories cover broken access control, security misconfiguration, cryptographic failures, injection attacks, insecure design, authentication failures, data integrity failures, and exception handling. Each category contains deliberately vulnerable web applications that demonstrate specific real-world weaknesses: for example, one easy challenge lets you access other users' documents by changing a number in a URL, while a harder challenge requires exploiting a flaw in how a server encrypts cookies. Every challenge runs as a single Docker container, which means you can start any challenge on your own machine with one command and reach it at a local web address. Each challenge folder includes the full source code, a write-up file that explains the solution and the technique involved, and support for injecting a custom flag at startup through an environment variable. This makes the collection suitable for running in CTF platforms that manage flags dynamically. The README includes a table mapping each challenge to its OWASP category, vulnerability type, and key technique, so learners can find challenges that match what they are studying. The project is MIT licensed and the README is available in both English and Simplified Chinese.