Web on Anthrace | CTF Writeups

UofTCTF 2026 - WEB Pasteboard

Sun, 11 Jan 2026 00:00:00 +0000

Web Challenge - - DOM clobbering + CSP bypass + RCE of Selenium’s WebDriver BiDi protocol Link to heading

It’s been a while since I had that much fun with a client-side challenge.

Pasteboard is a note-sharing web application where users can create and view notes. The challenge includes an admin bot that visits reported notes, so right off the bat I knew we were dealing with some client-side shenanigans.

BrunnerCTF 2025 - WEB Recipe for Disaster

Sun, 24 Aug 2025 00:00:00 +0000

This challenge demonstrates a classic prototype pollution vulnerability that leads to remote code execution through PATH hijacking. We exploit a dangerous deepMerge function to pollute Object.prototype.env, hijack the system’s PATH variable, and execute a malicious binary disguised as the legitimate zip command.

Overview & Attribution Link to heading

When I first tackled this challenge, I had a gut feeling we were dealing with prototype pollution. But the real “enlightment” moment came when I found an epic writeup Mizu at mizu.re. This absolute legend in the web security game, and his breakdown of a similar exploit was like finding the perfect recipe for this challenge. If you’re into this stuff, you have to check out Mizu’s work. His DOMPurify research is really insane. Huge props to them for sharing knowledge that helps us all level up!

HackDay - Web

Wed, 30 Jul 2025 00:00:00 +0000

Exploiting an XSS Vulnerability in a Blog with Moderator Visit Link to heading

In this challenge, we have a blog with a user registration and login system.
We know that the admin (or the moderator bot) will visit our profile when we register and when we post an article.

A source code leak is also available.

Step 1: Analyzing the Source Code Link to heading

Looking at the leaked source code, we notice an attempt at sanitization of the fields, but it is performed after the .save(), meaning that even if an error is displayed, the data is already stored in the database.

HackDay - Web

Wed, 30 Jul 2025 00:00:00 +0000

Flask Web Challenge - Template Injection Analysis Link to heading

In this challenge, we have a downloadable folder containing several files.

Step 1: Identifying the Web Framework Link to heading

By examining the requirements.txt and app.py files, we confirm that the application is built using Flask.

Step 2: Examining the Docker Configuration Link to heading

Looking into the docker-compose.yaml file, we notice that the application is using templates as an environment variable, which could be a potential security risk.

HackDay - Web

Wed, 30 Jul 2025 00:00:00 +0000

SQL Injection and Sensitive Data Retrieval

In this challenge, we are given a form with two fields: username and password. Our goal is to exploit a SQL Injection vulnerability to extract sensitive data from the database.

Step 1: Testing Basic Injection Link to heading

I started by testing a simple SQL injection in the password field. Here’s the payload I used:

username=admin&password='OR''='

Result: The server returns a list of users present in the database:

E-CTF-2025 - Web

Tue, 01 Jul 2025 00:00:00 +0000

Chatroom Link to heading

In this challenge, we are provided with access to a chatroom, where a message indicates that the admin will read our message in 30 seconds.

Upon seeing this, I immediately suspect a possible XSS (Cross-Site Scripting) vulnerability, as if the message is stored and executed in the admin’s browser, we could potentially inject malicious JavaScript.

Step 1 - Testing for XSS Injection Link to heading

To verify if the input is vulnerable to XSS, I test a simple payload:

DVCTF 2025 - WEB LouvreArchives

Mon, 26 May 2025 00:00:00 +0000

In this challenge, the goal is to access flag.webp as indicated in the source code.

While exploring the page, I noticed a long base64-encoded string. Once decoded and reorganized, it contained several .webp images with unusual names like 1991781613.webp, 1273827392.webp, etc.

Checking the source code:

We understand that filenames are generated using Python’s getrandbits(32), which produces 32 random bits via the random.getrandbits function.

The interesting point here is that this function uses the Mersenne Twister generator, a PRNG (Pseudo-Random Number Generator) that is not cryptographically secure.

RootMeCTF-20K - WEB-TraineeTrainee

Mon, 12 May 2025 00:00:00 +0000

Description:

The trainee made a weird commit that’s flooding the server with requests—and eventually blocking connections. We’re hinted that something strange is lurking in their Nginx setup.

As soon as we connect we have a file reader form. I stared with a whatweb

With this we know the backend runs a Nginx 1.24.0. I tried to research for a file like a file.txt, example.txt localhost and /etc/nginx because of what could be a nginx misconfiguration.

LA-CTF - Lucky flag

Mon, 10 Feb 2025 00:00:00 +0000

Challenge Description Link to heading

In this challenge, I was presented with a web page filled with thousands of buttons, all labeled “flag”.

The goal was to find the correct button that reveals the flag.

Step 1: Inspecting the Source Code Link to heading

Instead of clicking every single button, I looked into the main.js file which controls the behavior of the buttons.

Nullcon-Goa-HackIM-2025 - Web

Mon, 10 Feb 2025 00:00:00 +0000

Web Challenge - CRC Hash Collision Exploit Link to heading

Challenge Description Link to heading

In this challenge, we are provided with the source code of a PHP script along with two hints:

Hint 1: PHP documentation link for crc32()
Hint 2: A PHP CRC8 implementation

The goal is to retrieve the flag by bypassing an authentication mechanism based on CRC hashes.