All Writeups

Comprehensive collection of CTF challenges, solutions, and insights.


Filter by tag:

DEADROP Web 6 - weather.control.deadrop

A three-stage vulnerability chain - SQL injection to bypass authentication, IDOR to steal an admin API key from another operator's report, then command injection via the weather query endpoint to achieve RCE and read the flag.

DEADROP Web 1 - surveillance.archive.gov

Exploiting a UNION-based SQL injection in a fake government FOIA portal to extract a flag from a hidden table that the query was never meant to reach.