Blog
Web CTF writeups and bug bounty notes on how I broke each target. Auth, access control, injection, and logic flaws, with the steps and the mistakes.
EYCC: Mall Albostan
A search box concatenates SQL, so we UNION out the JWT secret, forge an admin token, sneak a .phtml shell past a blacklist, and pivot through a UTF-16 XXE to find where it landed. SQLi to RCE, end to end.
EYCC: EduSVG
The ID-card renderer trusted client-side SVG dimensions and piped them straight into a shell. rsvg-convert never stood a chance.
FlagYard — Tech Shop
Broken access control lets any user rewrite a product's description and top up their balance — then a second, unsafe render of that description in the order-history page turns it into Jinja2 SSTI and RCE.
BYUCTF: Power Tower
Multi-prime RSA where every factor is ≤ 2^16 and the exponent is a 25-high right-associative power tower. Factoring is trivial trial division; the real trick is inverting the tower via Euler's theorem applied recursively. The whole modulus chain stays 2^16-smooth.
BYUCTF: Mixed Signals
Two Go binaries: a process that turns 15 OS signals into VM opcodes via signal.Notify, and a driver that sends it 1817 signals. Recover the ISA from the dispatch, scrape the unrolled signal list, and since the VM is straight-line, let z3 hand you the flag.
BYUCTF: Angr Management
The name baits you toward symbolic execution. But a 'maze of gotos' built from literal cmp-imm → jmp edges is a static CFG. Parse the disassembly, BFS room 0 to the win room, replay 72 moves. No SMT, instant.
BYUCTF: Intro 2
A PIE binary disguised as a rev chal. Both branches call printf(buf) with no format string. Leak the PIE base via %39$p, then a manual %hn GOT overwrite points puts@got at win(), and the very next puts() fires the shell.
BYUCTF: Incontinent
Looks like a format-string bug, but printf uses a fixed %s. The real flaw: read() never null-terminates, so 32 bytes of padding bridge the gap to the flag buffer and %s over-reads straight into the secret.
BYUCTF: Hex to Int
A 'hex converter' with a signed table index and idx*4 addressing turns 'expand the table' into an arbitrary 4-byte write. Partial RELRO means a writable GOT, so point exit@got at win() and trigger it from the menu. Classic ret2win, no leak.
BYUCTF: heap2win
A C++ button app with a 16-byte %s overflow and a never-reachable WinnerButton::push that calls system("/bin/sh"). tcache reuse drops a Custom button right before a live Hype button, turning a forward-only overflow into a vtable-pointer overwrite. No leak, all constants.
FlagYard: OhMyQL
A GraphQL login mutation that signs whatever username you hand it. The DB layer concatenates strings into SQL. The flag gate just compares your JWT to your own input.
WebVerse Labs — Vellichor Press
The engineer left a TODO in the HTML. He never came back to finish it.
WebVerse Labs — Redirect Run
The browser followed the redirect. Burp didn't.
WebVerse Labs — Session Swap
The staff portal trusts the browser to tell the truth about who's logged in. It shouldn't.
HTB — DevArea: Chaining CXF LFI into Hoverfly RCE and Bash Hijack
no post.
TryHackMe — TakeOver Writeup
Subdomain enumeration challenge on TryHackMe. Finding a hidden subdomain via SSL certificate inspection to grab the flag.
0xL4ugh CTF v5 — Cracking AES with a Multimeter: Side-Channel Analysis
Breaking AES-128 without touching the algorithm — Correlation Power Analysis on a black-box hardware target using power traces and Hamming weight correlation.
OliCyber — Dependency Hell: Racing SQLite Session Store
Exploiting a TOCTOU race condition in a SQLite-backed Express session store to bypass balance checks and chain key purchases to get the flag.
HackerDNA — Hack the Cookie: Insecure Session Management
Privilege escalation from guest to admin by decoding and modifying an unsigned Base64 session cookie. A classic case of client-side trust gone wrong.
TAMU CTF 2025 — pittrap: Black-Box ONNX Neural Network Optimization
Solving a black-box neural network challenge at TAMU CTF (gigem) by treating the ONNX model as an oracle and applying simulated annealing to find the winning input.