All Writeups

Comprehensive collection of CTF challenges, solutions, and insights.


Filter by tag:

Raptor Weekly 6 - 3lectric Igloo - Web

Three flags across a penguin colony web app. Source recon, IDOR enumeration, OS command injection through a diagnostic ping utility, and AES-CBC decryption using keys leaked from the process environment.

Raptor Weekly 4 - Club Ouroboros - Web

Chaining IDOR vulnerabilities across a five-stage nightclub API to enumerate reservations, wristbands, drink orders, and lockers. Harvesting credentials across each loop until a session identity exploit unlocks the VIP room.

DEADROP Web 6 - weather.control.deadrop

A three-stage vulnerability chain - SQL injection to bypass authentication, IDOR to steal an admin API key from another operator's report, then command injection via the weather query endpoint to achieve RCE and read the flag.