Write-ups

Every write-up, most recently updated first.

Web OnboardX OnboardX is an employee-onboarding portal. New self-registered accounts are "pending HR approval"; approved employees get a JWT (token cookie, RS256 via JWKS); an HR/admin panel generates employee ID cards by running ImageMagick on an…
API Arclight 2 Arclight 2 is the sequel to Arclight 1: same Flask + GraphQL stack, but now the flag lives behind a rootVault query that is "root tier only". A fresh account gets role: standard.
API Arclight 1 Arclight is a Flask "staff portal". After registering and logging in you get a dashboard whose sections (Directory, Projects, Travel, Developer) each fetch /category/ and render tiny, sanitised JSON. The "Developer" section leaks the…
RE Secure Vault Two traps: (1) the SHA-256 password prompt, and (2) a decoy flag it reveals. The real flag is encoded inside the ELF program-header table and only reconstructed when the binary is run with a command-line argument.
RE Logic Bypass The program asks for an "access key". If an internal check passes it prints [ACCESS GRANTED] and then a flag. The twist (and the intended lesson, stated in the banner: "the decision is made here, not by a memory corruption bug") is that…
Cryptography Onion "Layers" and "make you cry" point to an onion: the flag is wrapped in several encodings, one inside the other. The way to solve it is to look at each layer, work out what it is, decode it, and then do the same with the result until…
IR Six Ways Out The title gives it away: six files leave the box over six different channels, each with its own encoding. The endpoint logs say what was taken and how it was encoded; the pcap holds the actual bytes.
LLM SecureBot Support The site is a chat assistant ("SecureBot") for AcmeCorp. Its system prompt contains a confidential master access code (the flag) and a hardened set of rules telling it to never reveal, hint at, spell out, encode, or translate that code.…
LLM AcmeBank Assistant The site is a chat assistant for "AcmeBank", authenticated as the customer user_42. It is backed by an account-lookup tool that accepts a user ID. The tool itself will look up any ID, but the model is told in its system prompt to only look…
Infra Healthy Hijack 2 Part 2 of Healthy Hijack. The deployment is the same vulnerable stack as part 1: a Flask "Safe Command Runner" with a startswith allowlist + metacharacter blacklist (newline bypass), and a world-writable root cron script…
Web TrollClock A Node/Express + ws app. The page shows a fake "one-time code" clock and claims a new challenge is issued every 37 seconds. The flag arrives over a WebSocket. The tagline is the hint: there are several dead-ends/decoys layered on top of…
Web The Dragon Warrior A Kung-Fu-Panda-themed React (Vite) front end talking to a FastAPI backend under /api. The flag lives at GET /api/scroll, which only opens to a player whose rank == "dragon-warrior". Rank is granted by POST /api/dragon-seal/certify, which…
Web DevNote DevNote is a tiny Flask app with a login page and a dashboard. The login page leaks guest credentials in an HTML comment. Once logged in, the dashboard exposes an internal "Dev Query Interface" at /dashboard?q= that drops the q parameter…
Mobile Latitude of Injection The app is called "Latitude of Injection", a hint at both its location check and its vulnerability. To get the flag, the platform needs two pieces of information:
LLM WebSummarizer Pro The app is an LLM chatbot with one tool, fetch_url, wrapped by a URL "safety policy". The goal is to make it fetch a protected internal endpoint anyway: a classic SSRF, but the filter being bypassed lives in the model's reasoning rather…
Infra Locks of Confusion 1 An "Internal Ops Portal" full of lore pages. The story: the svc-legacydb SSH keypair on legacy-03 (Debian 4.0 "etch", provisioned 2007-11-14) was carried forward through a 2011 P2V migration without regeneration: a key "decided long before…
Infra Healthy Hijack 1 A Flask "Safe Command Runner" runs only ping, traceroute, nslookup, with a blacklist that strips shell metacharacters. Two flaws chain to full root:
Cryptography Corrupted Vision I worked on a copy (cv.bin) in a scratch directory so the original stayed untouched.
API TradeBot TradeBot is not a normal web app: the health endpoint reveals a Model Context Protocol (MCP) server at /mcp. It exposes trading tools (get_stock_price, place_order, get_risk_report, …). There is a hidden restricted instrument FLAG…
RE Algebraic Nightmare x86-64, dynamically linked, stripped. SHA-256 44d57c21ef06c5efcbc2b59daa064e5073870252f111d2cbc9f08b53569662ba.
OSINT Westbound Kestrel Maritime is being extorted by an actor called nulltide. He claims to have planted a marker inside an encrypted export. We get phish.eml and offline copies of four of his sites (blog, file locker, git repo, vault). The README warns:…
OSINT Golden Hour "Stop pointing" refers to git refs: a force-push moves a branch to new commits, but the old commits are still on GitHub. "Walked away from" refers to an old LinkedIn handle and earlier commit history. "Locked" is the client-side encrypted…
IR Dead Drop An internet-facing server, web01.northstar.local (192.168.56.20), was compromised. We have three artifacts: incident.pcap, access.log and server_image.png. The attacker took data out of the network and tried to cover their tracks. The flag…