A mass assignment flaw in a dating-app API lets you escalate to admin and read a restricted chat. snakeCTF 2025 Quals web write-up.
Exploiting Jinja2 server-side template injection in a card generator to execute code. Pragyan CTF 2025 web write-up.
Leaking source through an endpoint, then exploiting Python template injection to retrieve the flag. Nullcon Goa HackIM 2025 web.
Bypassing Referer-based authentication through an Nginx and Express misconfiguration. HeroCTF v5 web write-up.
Spotting and exploiting a command injection in a QR code generator by controlling the size value. PwnMe 2023 web write-up.
Pivoting from a Facebook username to an exposed .git directory, then recovering the repo and flag. PwnMe 2023 OSINT write-up.
Combining bcrypt 72-byte truncation with email normalization to authenticate without knowing the password. ImaginaryCTF 2025 web.
Bursting concurrent requests to win a race in a custom CAPTCHA gate and reach the protected page. snakeCTF 2025 Quals web.
Bypassing numeric input validation through integer overflow in PHP to force a negative sum. Nullcon Goa HackIM 2025 web write-up.
Cracking a weak JWT secret, then pivoting to Jinja2 SSTI and RCE on a Flask app. HeroCTF v5 web write-up.
