API Attack Skill Assessment
Escalating from customer to supplier via role enumeration, security-question brute-force, and JWT re-authentication to achieve RCE.
Archive / 10 entries
Write-ups
Practical walkthroughs from reconnaissance to exploitation, including the dead ends and lessons that make each challenge useful.
GraphQL Skill Assessment
Exploiting GraphQL introspection to leak API keys, then chaining SQL injection through customer queries to dump the flag.
File Inclusion Skill Assessment
Chaining LFI path traversal, source code disclosure, and double URL encoding to gain RCE through an uploaded PHP shell.
No Notes CRLF Challenge | Hackena Ramadan CTF
Exploiting HTTP response splitting to steal cookies from an isolated bot using timing side-channel attacks.
Czechoslovakia XSS Challenge | Hackena Ramadan CTF
Exploiting XSS in a filtered input parameter using the /a// bypass technique to steal the admin bot's FLAG cookie through webhook exfiltration.
File Upload Skill Assessment
Chaining unrestricted file upload, path traversal, and double URL decoding to gain remote code execution.
SQL Injection Skill Assessment
Chaining SQL injection bypass, UNION-based enumeration, and INTO OUTFILE to gain RCE on a web application.
Web Fuzzing Skill Assessment
Directory fuzzing with ffuf to discover hidden files, admin panels, and restricted endpoints leading to the flag.
Information Gathering Skill Assessment
Reconnaissance methodology covering DNS enumeration, WHOIS lookups, subdomain discovery, and web footprinting to map an attack surface.
BCACTF 2025 Write-Up
Solving 10 challenges across Misc, Binary Exploitation, Crypto, and Web at BCACTF 2025.
No matching write-ups.
Try a different filter.