All Writeups

Comprehensive collection of CTF challenges, solutions, and insights.


Filter by tag:

DEADROP Web 3 - budget.internal.deadrop

Exploiting a Server-Side Template Injection vulnerability in an expense report submission form to extract a flag from the Flask application config via Jinja2's built-in config context variable.

DarkNet Services Penetration Test

Four-machine /24 network compromise, chaining SQLi, SSTI, SMB enumeration, SNMP credential extraction, LD_PRELOAD privesc, and PHP deserialization RCE to root all hosts, then hijacking a live Cloudflare-tunneled domain by replacing its Flask backend with a socat proxy to the defaced web server.