Web

A read-only anonymous FTP gateway turns out to be a Redis health-check proxy; abusing the PORT command for an FTP bounce plus a newline-smuggled RETR inline command yields a bidirectional Redis relay that scans the subnet and reads the flag.

A defensive web CTF where you patch the vulnerable source and the grader attacks your build: Secure the Login is fixed with parameterized queries, and Render & Plunder is sealed by binding SSTI input as render context plus adding an object-level authorization check to kill the IDOR.

A GraphQL vault chains a crackable HS256 JWT secret (the challenge name) for tier escalation with broken object-level authorization — the unreleased album is hidden from album(id) but leaks through the label→artists→albums path.

A static HTML page stuffed with a movie transcript hides the flag in a paragraph marked hidden=“true” — invisible in the browser but right there in the page source.

A PHP upload app re-encodes every GIF through PHP-GD as sanitization but never validates the filename — a payload smuggled inside the GIF color palette survives the re-encode, yielding a GIF/PHP polyglot webshell and RCE.

An alg:none JWT forgery grants admin, UNION-based SQLi reveals a hidden $99,999 vault dish, and a broken-authorization order flow lets the admin buy it for free — the flag arrives in a one-time Flask flash message.

A Kendrick-themed Flask app chains UNION-based SQLi to leak admin creds, an admin panel exposes an internal cipher microservice, and a Heartbleed-style over-read bleeds the AES-256 master key from heap memory to decrypt the flag.

A 4-digit PIN with no rate limiting falls to brute force, the dashboard’s ORDER BY sort is blind-SQL-injectable, and the home-made sanitizer only strips ‘<’ — so boolean extraction with ‘>’ dumps the secrets table.