Challenge Name: {{challenge_name}}  
Category: Web Exploitation

Description: {{challenge_description}}

Target URL: {{target_url}}

Provided Files:
{{#each files}}
{{#if code}}
`{{path}}`:
{{code}}

{{/if}} 
{{/each}}

To solve this web exploitation challenge, follow these steps:

1. Explore the target web app in a browser. Note down:
- Visible URLs and endpoints 
- Login/auth mechanisms
- Key functionality and pages
- User-supplied input fields 
- Technologies used (framework, frontend, backend, DB)

2. View page source and inspect HTTP traffic. Look for:
- HTML comments with clues/TODOs
- JavaScript source code 
- API endpoints and request/response formats
- Cookies, auth tokens, headers

3. Test for common web vulns:
- SQL injection in search/login/URLs 
- Cross-site scripting (XSS) in input fields
- Server-side template injection 
- Command injection 
- Directory traversal
- Insecure file uploads
- Broken access control for admin/hidden pages

4. If you find an exploitable vuln, craft a malicious payload:
- SQL injection to bypass login, dump DB, UNION query
- XSS to steal admin cookies/creds or call APIs 
- Template injection to leak source or run OS commands
- Directory traversal to view sensitive files

5. The flag is often in an admin page, DBdump, or source code file. Access it via the vulnerability.

Provide the vulnerable URL and your exploit payload. Stay within scope and rules - no scanning/attacking other targets.