All Writeups

Comprehensive collection of CTF challenges, solutions, and insights.


Filter by tag:

DEADROP Web 4 - leaks.secure-drop.deadrop

Bypassing Content-Security-Policy via inline event handlers to execute stored XSS against an admin bot, exfiltrating the admin session token via a built-in capture endpoint.

WHAMazon! Web 3 - The Review Queue

Exploiting a stored XSS vulnerability in a seller product submission form via an unsanitized image field to steal an admin review token.