https://th3b0ywh0l1v3d.github.io/categories/web/ Recent content in Web on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/beyond-the-homepage/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/beyond-the-homepage/ Flag hidden in an HTML comment, visible only via browser developer tools or view-source. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-1/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-1/ IDOR / broken access control lets you access another user’s flag by changing an ID parameter. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-2/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-2/ Part 2 of the Boro Senpai series: SSRF via Docker internal hostname. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-3/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-3/ Flag or unlock parameter hardcoded in client-side JavaScript. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/borogpt/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/borogpt/ Source-map leak reveals JWT secret, forge admin token, then exploit Jinja2 SSTI for RCE. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/cracking-the-vault/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/cracking-the-vault/ Password and flag hardcoded in client-side JavaScript — just read the source. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/dotdotslashflagtxt/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/dotdotslashflagtxt/ Classic path traversal — the challenge name tells you exactly what to do. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/drone-dash/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/drone-dash/ Node.js prototype pollution via POST /api/flight-profile grants admin access. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/kobenis-dashboard/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/kobenis-dashboard/ Abusing ImageMagick’s SVG text: pseudo-coder to read the flag file via server-side image conversion. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/neural-sync-portal/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/neural-sync-portal/ SSRF via Docker internal hostname to reach the metadata service and retrieve the flag. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/solarity/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/solarity/ Path traversal via /view?file=../flag.txt reads the server-side flag file. https://th3b0ywh0l1v3d.github.io/thm/el-bandito/ Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/el-bandito/ An exposed Spring Boot Actuator plus an nginx /.;/ path-ACL bypass leaks admin creds and the first flag; an HTTP/2 H2.CL desync then captures an internal bot’s request, stealing its flag cookie. https://th3b0ywh0l1v3d.github.io/thm/heartbleed/ Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/heartbleed/ A vulnerable nginx server exposes OpenSSL’s Heartbleed bug (CVE-2014-0160), allowing unauthenticated heap memory disclosure that leaks a plaintext HTTP POST body — and the flag — straight out of an active SSL session. https://th3b0ywh0l1v3d.github.io/thm/padelify/ Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/padelify/ A padel-tournament portal behind a deny-list ModSecurity WAF falls to a three-step chain: a User-Agent header bypass, a stored XSS that steals a moderator bot’s session cookie, and an LFI that leaks admin creds via full per-character URL-encoding. https://th3b0ywh0l1v3d.github.io/thm/plant-photographer/ Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/plant-photographer/ SSRF via a pycurl download endpoint chains into file:// LFI, Werkzeug debug PIN cracking, and full RCE on a Dockerised Flask app. https://th3b0ywh0l1v3d.github.io/thm/robots/ Mon, 08 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/robots/ XSS in a registration form exfiltrates the admin’s session cookie; RFI via the admin URL-tester gives www-data code execution; double-MD5 cracking yields SSH access, and a sudo apache2 logging trick writes a root SSH key. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/bouncer/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/bouncer/ A read-only anonymous FTP gateway turns out to be a Redis health-check proxy; abusing the PORT command for an FTP bounce plus a newline-smuggled RETR inline command yields a bidirectional Redis relay that scans the subnet and reads the flag. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/chakravyuh-defense/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/chakravyuh-defense/ A defensive web CTF where you patch the vulnerable source and the grader attacks your build: Secure the Login is fixed with parameterized queries, and Render & Plunder is sealed by binding SSTI input as render context plus adding an object-level authorization check to kill the IDOR. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/iceman/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/iceman/ A GraphQL vault chains a crackable HS256 JWT secret (the challenge name) for tier escalation with broken object-level authorization — the unreleased album is hidden from album(id) but leaks through the label→artists→albums path. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/baby-web/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/baby-web/ A static HTML page stuffed with a movie transcript hides the flag in a paragraph marked hidden=“true” — invisible in the browser but right there in the page source. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/cat-gifs/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/cat-gifs/ A PHP upload app re-encodes every GIF through PHP-GD as sanitization but never validates the filename — a payload smuggled inside the GIF color palette survives the re-encode, yielding a GIF/PHP polyglot webshell and RCE. https://th3b0ywh0l1v3d.github.io/ctf/zer0d4yh31st/web/dead-vault/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/zer0d4yh31st/web/dead-vault/ A Money Heist–themed Flask app hides a flag split into three fragments behind a server-side URL fetcher, bypassed with a DNS-based SSRF to reach the internal API and a privileged file-read endpoint. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/expensey-eats/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/expensey-eats/ An alg:none JWT forgery grants admin, UNION-based SQLi reveals a hidden $99,999 vault dish, and a broken-authorization order flow lets the admin buy it for free — the flag arrives in a one-time Flask flash message. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/heart-part-7/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/heart-part-7/ A Kendrick-themed Flask app chains UNION-based SQLi to leak admin creds, an admin panel exposes an internal cipher microservice, and a Heartbleed-style over-read bleeds the AES-256 master key from heap memory to decrypt the flag. https://th3b0ywh0l1v3d.github.io/ctf/zer0d4yh31st/web/la-casa-de-papel/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/zer0d4yh31st/web/la-casa-de-papel/ A Flask/Jinja2 app renders user-supplied names directly into a template, enabling SSTI that dumps os.environ to leak the flag stored as an environment variable. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/secretpickle/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/secretpickle/ A Pyodide client serializes requests with pickle obfuscated by a hardcoded XOR key, letting the server pickle.loads attacker data for unauthenticated root RCE, then hooking the live handler to capture the adminbot’s plaintext login password. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/secure-secretpickle/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/secure-secretpickle/ The hardened secretpickle runs pickle.loads in a write-only seccomp sandbox, but the adminbot action visits an attacker URL with no scheme check and returns a screenshot, so file:///flag.txt renders the flag into the image. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/secureform-admin/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/secureform-admin/ A 4-digit PIN with no rate limiting falls to brute force, the dashboard’s ORDER BY sort is blind-SQL-injectable, and the home-made sanitizer only strips ‘<’ — so boolean extraction with ‘>’ dumps the secrets table. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/simple-food-notifications/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/simple-food-notifications/ A Flask meal-notification SSRF whose is_global filter is defeated by abusing urllib3’s retry-driven DNS re-resolution — a global IP that hangs on port 80 (8.8.8.8) outlasts dnsmasq’s 2s cache, so the retry re-resolves to 127.0.0.1 and reaches the localhost-only /vip-meal. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/spaetzle/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/spaetzle/ An MD5-only oracle over arbitrary paths is turned into a full file disclosure using the error-based PHP filter-chain oracle to leak /flag byte-by-byte. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/tiny-web/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/tiny-web/ A one-line Node server lets you inject a rel=stylesheet entry into the Link response header, which Firefox applies to the flag-bearing page, enabling CSS attribute-selector exfiltration of the cookie. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/fancy-food-notifications/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/fancy-food-notifications/ Chaining a weak RNG seed (258 possible HMAC keys), an SSRF token leak, a urlparse vs urllib3 parser differential, and a URL-userinfo Basic-auth override to forge a VIP JWT and reach /vip-meal as localhost. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/restaurant-builder/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/restaurant-builder/ A FastAPI app builds Pydantic models from user-supplied field definitions, where each string value is eval()ed as a forward-reference annotation, yielding arbitrary code execution and flag exfiltration via the JSON schema.