All Writeups

Comprehensive collection of CTF challenges, solutions, and insights.

2026-03-01 Misc Insane

DEADROP Misc 6 - //CHAOS

A meta-challenge hidden across the DEADROP platform. No challenge listing, no files, no hints. Four flag fragments concealed using four different techniques, favicon MD5 steganography, a hidden 404 endpoint, zero-width Unicode in a checksum field, and a non-standard base64 meta attribute. Unit 7 says hello.

meta steganography osint unicode

2026-03-01 Misc Easy

DEADROP Misc 1 - BURNED ASSET PROFILE

A burned agency asset left a digital footprint. Follow the alias trail from a classified profile document to a LinkedIn lookalike, to a fake GitHub profile, to a commit where he accidentally pushed something he shouldn't have.

osint github linkedin social-media

2026-02-23 Web Medium

WHAMazon! Web 5 - Neural Backdoor

Chaining GitHub source code OSINT to discover a hidden SSRF endpoint, then using it to proxy requests to an internally-restricted AI core API.

ssrf server-side-request-forgery osint github

2026-02-22 Web Easy

WHAMazon! Web 2 - Employee of the Month

Combining GitHub OSINT with API endpoint discovery to find hardcoded admin credentials left in a public seed script.

osint source-code default-credentials recon