All Writeups

Comprehensive collection of CTF challenges, solutions, and insights.


Filter by tag:

Raptor Weekly 4 - Club Ouroboros - Web

Chaining IDOR vulnerabilities across a five-stage nightclub API to enumerate reservations, wristbands, drink orders, and lockers. Harvesting credentials across each loop until a session identity exploit unlocks the VIP room.

Raptor Weekly 1 - OMEGA CORP Web 1 - Raptor Riot Incident Response

Chaining prompt injection against an LLM-powered incident portal to extract a diagnostic key, pivoting through SSRF to reach a hidden internal endpoint, and leveraging RCE to comb a Windows filesystem until the flag surfaces in an abandoned exploit's source code.

DEADROP Web 3 - budget.internal.deadrop

Exploiting a Server-Side Template Injection vulnerability in an expense report submission form to extract a flag from the Flask application config via Jinja2's built-in config context variable.