https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/ Recent content in Web on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/secretpickle/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/secretpickle/ A Pyodide client serializes requests with pickle obfuscated by a hardcoded XOR key, letting the server pickle.loads attacker data for unauthenticated root RCE, then hooking the live handler to capture the adminbot’s plaintext login password. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/secure-secretpickle/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/secure-secretpickle/ The hardened secretpickle runs pickle.loads in a write-only seccomp sandbox, but the adminbot action visits an attacker URL with no scheme check and returns a screenshot, so file:///flag.txt renders the flag into the image. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/simple-food-notifications/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/simple-food-notifications/ A Flask meal-notification SSRF whose is_global filter is defeated by abusing urllib3’s retry-driven DNS re-resolution — a global IP that hangs on port 80 (8.8.8.8) outlasts dnsmasq’s 2s cache, so the retry re-resolves to 127.0.0.1 and reaches the localhost-only /vip-meal. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/spaetzle/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/spaetzle/ An MD5-only oracle over arbitrary paths is turned into a full file disclosure using the error-based PHP filter-chain oracle to leak /flag byte-by-byte. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/tiny-web/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/tiny-web/ A one-line Node server lets you inject a rel=stylesheet entry into the Link response header, which Firefox applies to the flag-bearing page, enabling CSS attribute-selector exfiltration of the cookie. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/fancy-food-notifications/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/fancy-food-notifications/ Chaining a weak RNG seed (258 possible HMAC keys), an SSRF token leak, a urlparse vs urllib3 parser differential, and a URL-userinfo Basic-auth override to forge a VIP JWT and reach /vip-meal as localhost. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/restaurant-builder/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/restaurant-builder/ A FastAPI app builds Pydantic models from user-supplied field definitions, where each string value is eval()ed as a forward-reference annotation, yielding arbitrary code execution and flag exfiltration via the JSON schema.