Th3B0yWh0L1v3d — Security Writeups

A Basic Start

Tue, 16 Jun 2026 00:00:00 +0000

Decoding a multi-layer encoding chain: Base64 followed by Base91.

AlphaCode

Tue, 16 Jun 2026 00:00:00 +0000

Reverse-engineering a custom esolang stack machine to recover the flag.

Amazing

Tue, 16 Jun 2026 00:00:00 +0000

Reversing a Python marshal bytecode maze generator seeded by an LCG to find the escape path.

Babel's Vault

Tue, 16 Jun 2026 00:00:00 +0000

Finding the flag inside the Library of Babel using a seed and image residual pixel indices.

Beyond the Homepage

Tue, 16 Jun 2026 00:00:00 +0000

Flag hidden in an HTML comment, visible only via browser developer tools or view-source.

Boro Hero

Tue, 16 Jun 2026 00:00:00 +0000

OSINT challenge: identify a Freehold High School alum from a blurred music photo — Bruce Springsteen.

Boro Senpai 1

Tue, 16 Jun 2026 00:00:00 +0000

IDOR / broken access control lets you access another user’s flag by changing an ID parameter.

Boro Senpai 2

Tue, 16 Jun 2026 00:00:00 +0000

Part 2 of the Boro Senpai series: SSRF via Docker internal hostname.

Boro Senpai 3

Tue, 16 Jun 2026 00:00:00 +0000

Flag or unlock parameter hardcoded in client-side JavaScript.

boroGPT

Tue, 16 Jun 2026 00:00:00 +0000

Source-map leak reveals JWT secret, forge admin token, then exploit Jinja2 SSTI for RCE.

cat

Tue, 16 Jun 2026 00:00:00 +0000

Reversing a repeating-key XOR crackme that downloads the flag from catbox.moe.

Chicken Dinner

Tue, 16 Jun 2026 00:00:00 +0000

Brute-force stack canary byte-by-byte via fork’s PID oracle, leak libc with puts, then ORW ROP chain.

Coming Together

Tue, 16 Jun 2026 00:00:00 +0000

Two’s complement INT_MIN negation overflow bypasses an absolute-value check to trigger the win condition.

Cracking the Vault

Tue, 16 Jun 2026 00:00:00 +0000

Password and flag hardcoded in client-side JavaScript — just read the source.

Disco Franklin

Tue, 16 Jun 2026 00:00:00 +0000

Decoding ASCII characters from RGB color blocks in a PNG image.

dotdotslashflagtxt

Tue, 16 Jun 2026 00:00:00 +0000

Classic path traversal — the challenge name tells you exactly what to do.

Drone Dash

Tue, 16 Jun 2026 00:00:00 +0000

Node.js prototype pollution via POST /api/flight-profile grants admin access.

Et Tu Brute

Tue, 16 Jun 2026 00:00:00 +0000

Classic Caesar cipher shifted by +3 conceals the flag.

Franklin

Tue, 16 Jun 2026 00:00:00 +0000

Recovering the flag from TrueType GSUB ligature substitution rules.

George Orwell

Tue, 16 Jun 2026 00:00:00 +0000

Decompiling a compiled AutoHotkey executable to extract the flag.

Hidden But Definitely Not

Tue, 16 Jun 2026 00:00:00 +0000

Recovering a flag hidden via stack-string construction and XOR obfuscation.

Kobeni's Dashboard

Tue, 16 Jun 2026 00:00:00 +0000

Abusing ImageMagick’s SVG text: pseudo-coder to read the flag file via server-side image conversion.

Mania

Tue, 16 Jun 2026 00:00:00 +0000

Use-after-free on a tcache chunk to overwrite a function pointer and call win().

Nature's Takeover

Tue, 16 Jun 2026 00:00:00 +0000

Identify the abandoned ship overgrown with vegetation from an OSINT image — SS Ayrfield.

Neural Sync Portal

Tue, 16 Jun 2026 00:00:00 +0000

SSRF via Docker internal hostname to reach the metadata service and retrieve the flag.

New to the Format

Tue, 16 Jun 2026 00:00:00 +0000

Blind format-string exploit with ASLR off: leak stack address then use %n + call rax to redirect execution.

Next Challenge (VULNBOT)

Tue, 16 Jun 2026 00:00:00 +0000

Reverse-psychology logic puzzle: telling the bot the flag IS the answer gets you the flag.

Not the Flag

Tue, 16 Jun 2026 00:00:00 +0000

Apply bitwise NOT to a hex string to reveal the flag.

Not Your Time

Tue, 16 Jun 2026 00:00:00 +0000

Crackme that stores the bitwise NOT of the flag bytes; invert them to get the flag.

Perfectly Destructive File

Tue, 16 Jun 2026 00:00:00 +0000

Extracting a flag hidden inside a PDF stream using FlateDecode and base64.

Solarity

Tue, 16 Jun 2026 00:00:00 +0000

Path traversal via /view?file=../flag.txt reads the server-side flag file.

Flip Dat Bit — TryHackMe

Tue, 09 Jun 2026 00:00:00 +0000

A TCP service hands you the AES-CBC ciphertext of your own input and asks you to return a ciphertext that decrypts to contain admin credentials — solved with a single-byte XOR flip.

Intermediate Nmap — TryHackMe

Tue, 09 Jun 2026 00:00:00 +0000

A full-range nmap scan uncovers a port 31337 service broadcasting SSH credentials in plaintext — connecting the dots between -sV output and an SSH login to grab the flag.

Reset — TryHackMe

Tue, 09 Jun 2026 00:00:00 +0000

Anonymous SMB leaks a default onboarding password; AS-REP roasting cracks TABATHA_BRITT; a three-link BloodHound ACL chain of forced password resets leads to DARLA_WINTERS, whose constrained delegation with protocol transition lets us impersonate Administrator via S4U2Self/S4U2Proxy for a full domain dump.

El Bandito — TryHackMe

Mon, 08 Jun 2026 00:00:00 +0000

An exposed Spring Boot Actuator plus an nginx /.;/ path-ACL bypass leaks admin creds and the first flag; an HTTP/2 H2.CL desync then captures an internal bot’s request, stealing its flag cookie.

HeartBleed — TryHackMe

Mon, 08 Jun 2026 00:00:00 +0000

A vulnerable nginx server exposes OpenSSL’s Heartbleed bug (CVE-2014-0160), allowing unauthenticated heap memory disclosure that leaks a plaintext HTTP POST body — and the flag — straight out of an active SSL session.

Padelify — TryHackMe

Mon, 08 Jun 2026 00:00:00 +0000

A padel-tournament portal behind a deny-list ModSecurity WAF falls to a three-step chain: a User-Agent header bypass, a stored XSS that steals a moderator bot’s session cookie, and an LFI that leaks admin creds via full per-character URL-encoding.

Plant Photographer — TryHackMe

Mon, 08 Jun 2026 00:00:00 +0000

SSRF via a pycurl download endpoint chains into file:// LFI, Werkzeug debug PIN cracking, and full RCE on a Dockerised Flask app.

Robots — TryHackMe

Mon, 08 Jun 2026 00:00:00 +0000

XSS in a registration form exfiltrates the admin’s session cookie; RFI via the admin URL-tester gives www-data code execution; double-MD5 cracking yields SSH access, and a sudo apache2 logging trick writes a root SSH key.

Bandaids Help me Heal — DalCTF 2026

Sun, 07 Jun 2026 00:00:00 +0000

A ‘pwn’ binary with no input is really a static-reversing puzzle: a fake usleep loop would take days and a fake integrity check always passes, so reading the constants and undoing a single-byte XOR yields the flag without ever waiting.

Bouncer — DalCTF 2026

Sun, 07 Jun 2026 00:00:00 +0000

A read-only anonymous FTP gateway turns out to be a Redis health-check proxy; abusing the PORT command for an FTP bounce plus a newline-smuggled RETR inline command yields a bidirectional Redis relay that scans the subnet and reads the flag.

Card Trick — DalCTF 2026

Sun, 07 Jun 2026 00:00:00 +0000

A trivia/OSINT puzzle: identify Valve’s unreleased game Deadlock and the hero Wraith, then read the shipped ability data (Card Trick) from the community API to get the suit order, max-level stat modifiers, and card-charge count for the flag.

Chakravyuh Defense — DalCTF 2026

Sun, 07 Jun 2026 00:00:00 +0000

A defensive web CTF where you patch the vulnerable source and the grader attacks your build: Secure the Login is fixed with parameterized queries, and Render & Plunder is sealed by binding SSTI input as render context plus adding an object-level authorization check to kill the IDOR.

Connected — HackTheBox

Sun, 07 Jun 2026 00:00:00 +0000

A Hard Linux machine running FreePBX — full writeup locked until the box retires.

Fun With RSA — DalCTF 2026

Sun, 07 Jun 2026 00:00:00 +0000

A homemade RSA-CRT signer leaks a correct and a faulted signature of the same message; gcd(s − spz, n) factors n (the Bellcore attack), while the trivial shortcut just recovers the message via s^e mod n — and the XOR ‘protection’ undoes itself.

ICEMAN — DalCTF 2026

Sun, 07 Jun 2026 00:00:00 +0000

A GraphQL vault chains a crackable HS256 JWT secret (the challenge name) for tier escalation with broken object-level authorization — the unreleased album is hidden from album(id) but leaks through the label→artists→albums path.

Lost My Flag Printer — DalCTF 2026

Sun, 07 Jun 2026 00:00:00 +0000

A setuid helper pins an eBPF flag-printer into a world-accessible PROG_ARRAY then chmod 000s the program pin; loading an unprivileged socket-filter that bpf_tail_calls index 0 runs the root-loaded printer and fills the readable flag map.

Password Vault — DalCTF 2026

Sun, 07 Jun 2026 00:00:00 +0000

A password-manager heap challenge: free() without nulling the pointer gives a use-after-free, tcache hands the freed Login chunk back via set_password, and overwriting the struct’s leading function pointer redirects an indirect call to the leftover read_master_key win function.

Slot Machine — DalCTF 2026

Sun, 07 Jun 2026 00:00:00 +0000

A textbook ret2win: gets() into a 32-byte stack buffer with no canary and no PIE lets us overwrite the saved return address with jackpot(); the only twist is closing stdin to force the menu loop’s EOF break so the corrupted return fires.

someone said steg? — DalCTF 2026

Sun, 07 Jun 2026 00:00:00 +0000

A 16-frame APNG hides one flag character per frame in the top-left pixel of each frame’s decompressed scanline data; every standard stego avenue is a dead end, so decompressing all 16 fdAT/IDAT streams and reading byte 4 of each yields the flag.

Spoiled Cheese Pull — DalCTF 2026

Sun, 07 Jun 2026 00:00:00 +0000

A ‘PNG’ that file() calls a broken JPEG is a PNG with a forged signature and vandalized chunk names; repairing the header reveals an rMQR (rectangular Micro QR) barcode that ZXing decodes to the flag.

All's Fair in Love and CTFs — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

The title ‘All’s Fair’ points at the Playfair cipher; the grid image is the standard 5×5 key square with even columns blanked, and the ciphertext decrypts to ANYTHINGFORTHEFLAG.

Angry Shamir — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

An RSA modulus that looks 2054-bit-strong is actually 67 × q — a tiny prime factor makes it trivially factorable (FactorDB / trial division), reconstructing the private key and decrypting the flag.

Baby Android — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

A single APK whose UI claims there’s nothing to see — the flag is split into three pieces hidden in a MainActivity field, a string resource, and a Compose theme getter.

Baby Web — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

A static HTML page stuffed with a movie transcript hides the flag in a paragraph marked hidden=“true” — invisible in the browser but right there in the page source.

Bit Miner — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

An idle/clicker TCP game whose shop checks affordability against a stale cached balance but deducts from a fresh re-read; racing two sessions as the same user underflows an unsigned long to ~1.8e19 bits and buys the flag.

Cat GIFs — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

A PHP upload app re-encodes every GIF through PHP-GD as sanitization but never validates the filename — a payload smuggled inside the GIF color palette survives the re-encode, yielding a GIF/PHP polyglot webshell and RCE.

Compression isn't encryption — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

A 192-bit Huffman stream and a frequency table; the textbook min-heap decode looks perfect (wrapped in dalctf{}, zero leftover bits) yet is wrong — matching the encoder’s tie-break policy recovers the real flag.

DEAD VAULT — Zer0d4yh31st CTF

Sat, 06 Jun 2026 00:00:00 +0000

A Money Heist–themed Flask app hides a flag split into three fragments behind a server-side URL fetcher, bypassed with a DNS-based SSRF to reach the internal API and a privileged file-read endpoint.

Do You Know The Way? — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

A UPX-packed, unstripped crackme lays its 44-byte check out as 44 independent per-character functions; emulating each with Unicorn brute-forces the flag one byte at a time, sidestepping a rand()-based anti-dynamic trap.

Espresso — HackTheBox Hardware

Sat, 06 Jun 2026 00:00:00 +0000

An ESP32 firmware reversing challenge — full writeup locked until the challenge retires.

Expensey Eats — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

An alg:none JWT forgery grants admin, UNION-based SQLi reveals a hidden $99,999 vault dish, and a broken-authorization order flow lets the admin buy it for free — the flag arrives in a one-time Flask flash message.

Haskell2 — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

A stripped compiler for an invented language is reverse-engineered from its error strings and codegen templates; the recovered grammar exposes an intended read file primitive that simply prints flag.txt — no exploit required.

Heart Part 7 — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

A Kendrick-themed Flask app chains UNION-based SQLi to leak admin creds, an admin panel exposes an internal cipher microservice, and a Heartbleed-style over-read bleeds the AES-256 master key from heap memory to decrypt the flag.

La Casa de Papel (Secure Comms) — Zer0d4yh31st CTF

Sat, 06 Jun 2026 00:00:00 +0000

A Flask/Jinja2 app renders user-supplied names directly into a template, enabling SSTI that dumps os.environ to leak the flag stored as an environment variable.

LCG Seed Squared — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

A homemade LCG-as-cipher multiplies each flag byte by a deterministic state independent of the plaintext — the known DalCTF{ prefix recovers one state, and replaying the generator divides out the rest. The lost seed is a red herring.

Playing with Pointers — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

A C program squares each flag byte as a float, then a ‘forgotten’ Quake-style (long)&y type-pun prints the raw IEEE-754 bits as integers; reversing bits→float→sqrt→char recovers the flag.

SecretPickle — GPN CTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

A Pyodide client serializes requests with pickle obfuscated by a hardcoded XOR key, letting the server pickle.loads attacker data for unauthenticated root RCE, then hooking the live handler to capture the adminbot’s plaintext login password.

Secure Secretpickle — GPN CTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

The hardened secretpickle runs pickle.loads in a write-only seccomp sandbox, but the adminbot action visits an attacker URL with no scheme check and returns a screenshot, so file:///flag.txt renders the flag into the image.

SecureForm Admin — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

A 4-digit PIN with no rate limiting falls to brute force, the dashboard’s ORDER BY sort is blind-SQL-injectable, and the home-made sanitizer only strips ‘<’ — so boolean extraction with ‘>’ dumps the secrets table.

Simple Food Notifications — GPN CTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

A Flask meal-notification SSRF whose is_global filter is defeated by abusing urllib3’s retry-driven DNS re-resolution — a global IP that hangs on port 80 (8.8.8.8) outlasts dnsmasq’s 2s cache, so the retry re-resolves to 127.0.0.1 and reaches the localhost-only /vip-meal.

Spaetzle — GPN CTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

An MD5-only oracle over arbitrary paths is turned into a full file disclosure using the error-based PHP filter-chain oracle to leak /flag byte-by-byte.

Tiny Web — GPN CTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

A one-line Node server lets you inject a rel=stylesheet entry into the Link response header, which Firefox applies to the flag-bearing page, enabling CSS attribute-selector exfiltration of the cookie.

Warmer Up — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

The challenge file is the CTF’s own rules PDF — the flag sits in plain text as the last line; pdftotext reveals it, after ruling out post-EOF carving and active content.

Warmerer Up — DalCTF 2026

Sat, 06 Jun 2026 00:00:00 +0000

A 4.9 MB rules PDF hides 360 fake 1×1 image XObjects holding base64 chunks that reassemble into an encrypted ZIP; the password is hidden in the rules text, inside is a Singularity .sif whose squashfs holds the flag.

COMpetition — GPN CTF 2026

Fri, 05 Jun 2026 00:00:00 +0000

A commit-reveal rock-paper-scissors whose non-binding sha256(r1 + message + r2) commitment lets you open one hash to any winning move and sweep all 100 rounds.

Double Fried — GPN CTF 2026

Fri, 05 Jun 2026 00:00:00 +0000

A pcap leaks a flag one character per syslog packet in scrambled order, and sorting by each packet’s Message ID field reassembles the flag.

Easy DSA — GPN CTF 2026

Fri, 05 Jun 2026 00:00:00 +0000

A P-521 ECDSA oracle derives its nonce from an MD5-based uuid3, so an MD5 collision forces nonce reuse, leaks the private key, and lets us forge a signature for the flag.

Fancy Food Notifications — GPN CTF 2026

Fri, 05 Jun 2026 00:00:00 +0000

Chaining a weak RNG seed (258 possible HMAC keys), an SSRF token leak, a urlparse vs urllib3 parser differential, and a URL-userinfo Basic-auth override to forge a VIP JWT and reach /vip-meal as localhost.

Königsberg Delivery Problem — GPN CTF 2026

Fri, 05 Jun 2026 00:00:00 +0000

Reversing a 250-state control-flow-flattened automaton whose success check requires visiting every state — i.e. finding a Hamiltonian path through the transition graph.

Leftover Leftovers — GPN CTF 2026

Fri, 05 Jun 2026 00:00:00 +0000

A two-stage Java AOT-cache app whose integrity hash covers bytecode and pointers but not the archived heap — patching the pre-resolved heap String redirects the image directory and reads /flag.

Leftovers — GPN CTF 2026

Fri, 05 Jun 2026 00:00:00 +0000

Reversing a Javalin app whose real password validator lives in an AOT/CDS cache that overrides the jar — dumping the loaded class with the HotSpot Serviceability Agent unlocks a file-read to /flag.

Paradise Nut — GPN CTF 2026

Fri, 05 Jun 2026 00:00:00 +0000

Abusing pnut-sh’s C-to-shell codegen, where a C local named REPLY aliases the tainted shell $REPLY from gets() and detonates command execution via bash arithmetic to run the setuid nl on /flag.

Recipe for Disaster — GPN CTF 2026

Fri, 05 Jun 2026 00:00:00 +0000

A food-ordering binary reads chef notes with gets() into a buffer sitting in front of an int price field, letting an overflow set a negative price that makes the order total negative and prints /flag.

Restaurant Builder — GPN CTF 2026

Fri, 05 Jun 2026 00:00:00 +0000

A FastAPI app builds Pydantic models from user-supplied field definitions, where each string value is eval()ed as a forward-reference annotation, yielding arbitrary code execution and flag exfiltration via the JSON schema.

Volatile Component — GPN CTF 2026

Fri, 05 Jun 2026 00:00:00 +0000

Exploiting a GitHub Actions workflow that interpolates an untrusted issue body into a run block, gaining RCE to dump the FLAG secret from the Runner.Worker process memory and exfiltrating it as hex to bypass log masking.

About

Mon, 01 Jan 0001 00:00:00 +0000

about