CTF Writeups
Documented security research — vulnerability analysis, exploitation methodology, and remediation. Every command is explained, not just listed.
All writeups
tomghost
Chained an unpatched Tomcat AJP connector into root — Ghostcat (CVE-2020-1938) unauthenticated file read, a credential leaked in web.xml, a cracked PGP passphrase, then a sudo/zip GTFOBins misconfiguration.
Domino
Chained seven weaknesses into a root shell and all 5 flags — user enumeration, IDOR, blind XSS session hijack, JWT alg:none forgery, RFI to RCE, password reuse, then a group-writable cron script.
Flag Vault 2
Exploited a format string vulnerability (CWE-134) in printf() to leak a flag from stack memory — no buffer overflow needed.
Flag Vault
Exploited a stack buffer overflow (CWE-121) via gets() to overwrite an adjacent stack variable and bypass authentication.
Capture!
Built a custom Python script to enumerate valid usernames via differential error messages and solve math-based CAPTCHAs programmatically.
Simple CTF
Exploited CVE-2019-9053 (time-based blind SQLi, CVSSv3.0 8.1) in CMS Made Simple to extract credentials, then escalated to root via vim sudo misconfiguration.
Pickle Rick
Retrieved credentials via information disclosure in HTML comments and robots.txt, then achieved RCE and root escalation through a misconfigured sudo policy.