An unintended keep-alive bug: a stale client_addr lets you smuggle a privileged request past the auth check. ImaginaryCTF 2025.
Escaping a PHP eval sandbox with a quote-less, digit-less function chain to reach RCE. Nullcon Berlin HackIM 2025 web write-up.
Privilege escalation via user-controlled settings in a Next.js GraphQL pastebin (isAdmin:true). snakeCTF 2025 Quals web write-up.
Brute-forcing a Flask admin panel behind an XML employee list to turn a 403 into a 200. Pragyan CTF 2025 web write-up.
Reversing PHP mt_rand() with php_mt_seed to recover a flag leaked through session IDs, chunk by chunk. Nullcon Goa HackIM 2025.
Abusing GraphQL alias batching to bypass a rate limit and stuff a voting endpoint into first place. HeroCTF v5 web write-up.
Bypassing a preg_match filter over shell_exec to read flag.txt via command injection. PwnMe 2023 web write-up.
Pivoting across a bilingual target's social accounts where key information hides in only one language. PwnMe 2023 OSINT write-up.
Abusing Perl's two-argument open for command execution via a trailing pipe and newline injection. ImaginaryCTF 2025 web write-up.
Winning a TOCTOU race in a web.py login flow to bypass MFA and read the flag. Nullcon Berlin HackIM 2025 web write-up.
