Write-ups
15 challenge solutions
Intigriti 1021: Halloween Has Taken Over
2025DOM XSS with a CSP bypass
PwnMe CTF 2025: ProfileEditor
2025Path traversal through a crafted username
Hack The Box: Pinned
2025Certificate pinning, read from decompiled Java
FlagYard: Glide
2024A substring check defeats a 4-digit OTP
HeroCTF: SampleHub
2024Directory traversal through a crafted download filename
HeroCTF: Jinjatic
2024Server-side template injection in Jinja2 email templates
HeroCTF: PrYzes
2024A request signature anyone can compute, and a date past 2100
FlagYard: OhMyPatch
2024JSON Patch abuse makes a new account admin
FlagYard: Meters flag
2024XXE past a payload filter, encoded as UTF-7
FlagYard: Feedback
2024SQL injection through a string-formatted feedback query
FlagYard: Nooter
2024SQL injection past a keyword blacklist
TryHackMe: Blue
2021EternalBlue (MS17-010) against Windows, with Metasploit
TryHackMe: Further Nmap
2021Nmap scan types and switches, question by question
TryHackMe: Hydra
2021Brute-forcing SSH and a web login form with Hydra
TryHackMe: Metasploit
2021The room's Metasploit basics, question by question