Canon Collapse | IEEE VICTORIS CTF 2026 Qualifications
Chaining a JSON parser differential, an escaped duplicate key to smuggle past the WAF, and a fullwidth NFKC normalization gap to export prime/audit-final as demo.
Archive / 12 entries
CTF Write-ups
Tired of Running | AFRICC 2027 Qualifiers CTF
Full chain walkthrough: uint16 length overflow to smuggle osquery SQL fields, login bypass, a YARA oracle for byte-by-byte credential exfiltration, and CRLF request smuggling to POST the credential to an internal flag server.
API Attack Skill Assessment | CWES Path on HTB
Escalating from customer to supplier via role enumeration, security-question brute-force, and JWT re-authentication to achieve RCE.
Attacking GraphQL Skill Assessment | CWES on HTB
Exploiting GraphQL introspection to leak API keys, then chaining SQL injection through customer queries to dump the flag.
File Inclusion Skill Assessment | CWES Path on HTB
Chaining LFI path traversal, source code disclosure, and double URL encoding to gain RCE through an uploaded PHP shell.
No Notes CRLF Challenge | Hackena Ramadan CTF
Exploiting HTTP response splitting to steal cookies from an isolated bot using timing side-channel attacks.
Czechoslovakia XSS Challenge | Hackena Ramadan CTF
Exploiting XSS in a filtered input parameter using the /a// bypass technique to steal the admin bot's FLAG cookie through webhook exfiltration.
File Upload Skill Assessment | CWES Path on HTB
Chaining unrestricted file upload, path traversal, and double URL decoding to gain remote code execution.
SQL Injection Skill Assessment | CWES Path on HTB
Chaining SQL injection bypass, UNION-based enumeration, and INTO OUTFILE to gain RCE on a web application.
Web Fuzzing Skill Assessment | CWES Path on HTB
Directory fuzzing with ffuf to discover hidden files, admin panels, and restricted endpoints leading to the flag.
Information Gathering Skill Assessment | CWES Path on HTB
Reconnaissance methodology covering DNS enumeration, WHOIS lookups, subdomain discovery, and web footprinting to map an attack surface.
BCACTF 2025 Write-Up
Solving 10 challenges across Misc, Binary Exploitation, Crypto, and Web at BCACTF 2025.
No matching write-ups.
Try a different filter.