12 posts found
5 min read
A Rust reverse proxy guards /admin with a naive prefix check. It lowercases the path but never decodes it, so a percent-encoded byte slips the request past the proxy and straight into the Flask route that returns the flag.
#CTF#Cybersecurity#Web
6 min read
A paste site sanitizes with DOMPurify and then feeds the result to String.prototype.replace: the $& and $` replacement patterns smuggle a live iframe past the sanitizer, and a /hidden-scoped flag cookie is read through a same-origin 404 frame.
#CTF#Cybersecurity#Web
7 min read
A PHP stream filter that hashes whatever it reads turns into an oracle: chain an SSRF in hash.php through a public redirector to a localhost-only secret reader, then recover the flag one byte at a time from a 500-vs-200 side channel.
#CTF#Cybersecurity#Web
4 min read
A voting app mints Biscuit capability tokens from the username you type. The username is pasted straight into Datalog source, so a crafted signup injects a role("admin") fact into a token the server signs for you and unlocks the staff room flag.
#CTF#Cybersecurity#Web
5 min read
An Elysia note-storage app keys every action on a cookie the client holds, and falls back to a hardcoded signing secret outside production. Sign a user=1000 cookie with that secret and the admin's stored flag comes straight back.
#CTF#Cybersecurity#Web
4 min read
Pickle RCE is sandboxed and the client HTML is sanitized, so the flag comes from the admin bot instead: it visits any URL you hand it, including file:///flag.txt, and returns the screenshot.
#CTF#Cybersecurity#Web
4 min read
A vault that only lets you read your own secrets, until the settings endpoint lets you overwrite the session user_id and the vault query filters on the wrong column.
#CTF#Cybersecurity#Web
10 min read
A WordPress bureau where a subscriber spoofs an admin screen to leak a nonce, then a five-stage client-to-server chain ends in a php://filter RCE and a keeper hash length-extension to read the flag.
#CTF#Cybersecurity#Web
6 min read
Three small Rails mistakes chain together: an attacker-controlled constantize leaks the JWT signing secret, the admin middleware accepts any HS256 token signed with it, and an array query parameter defeats the reserved-post check to return the flag.
#CTF#Cybersecurity#Web
6 min read
Trusted Types and a regex sanitizer bypassed in a Flask notes app: an HTML-entity-encoded iframe srcdoc runs inline script under CSP, reads the admin-only /admin/flag, and exfiltrates it via top-level navigation.
#CTF#Cybersecurity#Web
4 min read
A two-character quote ban, escaping the closing quote with a backslash, a hex-encoded UNION injection, and an SSTI in /home via render_template_string that ends in RCE.
#CTF#Cybersecurity#SQL Injection
4 min read
DOMPurify is fine — the bug is a raw server-side sink plus DOM clobbering: I hijack window.renderConfig to force a throw, then use window.errorReporter.path.value to load an arbitrary script under strict-dynamic and exfiltrate the bot's cookie.
#CTF#Cybersecurity#XSS