Writeup on Anthrace | CTF Writeups

UofTCTF 2026 - WEB Pasteboard

Sun, 11 Jan 2026 00:00:00 +0000

Web Challenge - - DOM clobbering + CSP bypass + RCE of Selenium’s WebDriver BiDi protocol Link to heading

It’s been a while since I had that much fun with a client-side challenge.

Pasteboard is a note-sharing web application where users can create and view notes. The challenge includes an admin bot that visits reported notes, so right off the bat I knew we were dealing with some client-side shenanigans.

BrunnerCTF 2025 - WEB Recipe for Disaster

Sun, 24 Aug 2025 00:00:00 +0000

This challenge demonstrates a classic prototype pollution vulnerability that leads to remote code execution through PATH hijacking. We exploit a dangerous deepMerge function to pollute Object.prototype.env, hijack the system’s PATH variable, and execute a malicious binary disguised as the legitimate zip command.

Overview & Attribution Link to heading

When I first tackled this challenge, I had a gut feeling we were dealing with prototype pollution. But the real “enlightment” moment came when I found an epic writeup Mizu at mizu.re. This absolute legend in the web security game, and his breakdown of a similar exploit was like finding the perfect recipe for this challenge. If you’re into this stuff, you have to check out Mizu’s work. His DOMPurify research is really insane. Huge props to them for sharing knowledge that helps us all level up!

HackDay - Stegano

Wed, 30 Jul 2025 00:00:00 +0000

In this challenge, we are provided with a .wav file that, at first glance, appears to be a simple audio file. Our task is to analyze the file and uncover a hidden flag.

Step 1: Playing the Audio Link to heading

I started by playing the audio, expecting something unusual—perhaps some hidden message or distortion—but everything sounded normal. There was no apparent clue in the audio playback.

HackDay - Stegano & Forensic

Wed, 30 Jul 2025 00:00:00 +0000

Forensic Challenge - Hidden Flag Extraction Link to heading

In this challenge, we have a ZIP file containing a log file and two images.

Step 1: Log File Analysis Link to heading

I began by analyzing the log file and found five encoded words. I used dcode.fr to decode them:

ercbafr (ROT13) → reponse

c29sdXRpb24= (Base64) → solution

HackDay - Web

Wed, 30 Jul 2025 00:00:00 +0000

Exploiting an XSS Vulnerability in a Blog with Moderator Visit Link to heading

In this challenge, we have a blog with a user registration and login system.
We know that the admin (or the moderator bot) will visit our profile when we register and when we post an article.

A source code leak is also available.

Step 1: Analyzing the Source Code Link to heading

Looking at the leaked source code, we notice an attempt at sanitization of the fields, but it is performed after the .save(), meaning that even if an error is displayed, the data is already stored in the database.

HackDay - Web

Wed, 30 Jul 2025 00:00:00 +0000

Flask Web Challenge - Template Injection Analysis Link to heading

In this challenge, we have a downloadable folder containing several files.

Step 1: Identifying the Web Framework Link to heading

By examining the requirements.txt and app.py files, we confirm that the application is built using Flask.

Step 2: Examining the Docker Configuration Link to heading

Looking into the docker-compose.yaml file, we notice that the application is using templates as an environment variable, which could be a potential security risk.

HackDay - Web

Wed, 30 Jul 2025 00:00:00 +0000

SQL Injection and Sensitive Data Retrieval

In this challenge, we are given a form with two fields: username and password. Our goal is to exploit a SQL Injection vulnerability to extract sensitive data from the database.

Step 1: Testing Basic Injection Link to heading

I started by testing a simple SQL injection in the password field. Here’s the payload I used:

username=admin&password='OR''='

Result: The server returns a list of users present in the database:

E-CTF-2025 - Crypto

Tue, 01 Jul 2025 00:00:00 +0000

Step 1: Analyzing the Challenge Link to heading

The challenge provides a series of ASCII numbers along with an intriguing phrase:

108 100 111 109 123 85 99 49 122 95 106 53 95 79 111 51 95 88 52 116 95 48 109 95 51 111 88 121 90 107 97 106 48 105 125 10 10 69 98 111 98 32 102 112 32 118 108 114 111 32 104 98 118 44 32 100 108 108 97 32 105 114 122 104 32 58 32 72 66 86 72 66 86 10 10 87 101 108 108 32 100 111 110 101 44 32 98 117 116 32 110 111 119 32 100 111 32 121 111 117 32 107 110 111 119 32 97 98 111 117 116 32 116 104 101 32 103 117 121 32 119 104 111 32 103 111 116 32 115 116 97 98 98 101 100 32 50 51 32 116 105 109 101 115 32 63

Step 2: Decoding ASCII Link to heading

I used DCode to convert the ASCII numbers into text.

E-CTF-2025 - Forensic

Tue, 01 Jul 2025 00:00:00 +0000

Step 1: Opening the ZIP File Link to heading

The challenge provides a ZIP file containing a PCAP file.

Objective: Analyze the PCAP to identify data exfiltration and retrieve the flag.

Step 2: Initial PCAP Analysis Link to heading

I opened the PCAP file with Wireshark and began analyzing the packets.

Main observations:

Evidence of data exfiltration within network traffic.
Interesting endpoints used for file transfer.
A suspicious POST request.

E-CTF-2025 - Forensic

Tue, 01 Jul 2025 00:00:00 +0000

Challenge Description Link to heading

We are provided with a .zip file containing a .pcap file. The instructions indicate an image has been stolen, and we must recover it from the PCAP file.

Step 1: PCAP File Analysis Link to heading

I opened the .pcap file with Wireshark to inspect the network traffic.

Observations:

I noticed suspicious DNS requests sent to data.exfil.attacker.com.
This suggests data exfiltration via DNS by encoding the image within domain names.

Step 2: Extracting Exfiltrated Data Link to heading

To extract all DNS queries from the PCAP, I used Tshark:

E-CTF-2025 - Forensic

Tue, 01 Jul 2025 00:00:00 +0000

Step 1: Downloading the ZIP File Link to heading

The challenge provides a ZIP file containing a DOCX file.

Hypothesis: A DOCX file is actually a ZIP archive, meaning we can extract its internal content.

Step 2: Extracting the DOCX Content Link to heading

I used unzip to extract the content of the DOCX file.

Result:

Several folders and XML files.
A folder named word/ containing metadata and content.

Step 3: Analyzing Extracted Files Link to heading

I explored all the files extracted from the DOCX, looking for hidden information.

E-CTF-2025 - Web

Tue, 01 Jul 2025 00:00:00 +0000

Chatroom Link to heading

In this challenge, we are provided with access to a chatroom, where a message indicates that the admin will read our message in 30 seconds.

Upon seeing this, I immediately suspect a possible XSS (Cross-Site Scripting) vulnerability, as if the message is stored and executed in the admin’s browser, we could potentially inject malicious JavaScript.

Step 1 - Testing for XSS Injection Link to heading

To verify if the input is vulnerable to XSS, I test a simple payload:

Midnight-Flag-Finals - Osint

Sat, 21 Jun 2025 00:00:00 +0000

Operation Silent Hunt Link to heading

Challenge Description Link to heading

During the theft of a hard drive containing sensitive data, the attacker made a mistake: they lost their phone at the scene.
Your mission: follow the clues and locate the exact address where the hard drive is hidden.

But be careful… getting caught could compromise the entire operation.

🔍 Only use the following websites for your investigation:

DVCTF 2025 - WEB LouvreArchives

Mon, 26 May 2025 00:00:00 +0000

In this challenge, the goal is to access flag.webp as indicated in the source code.

While exploring the page, I noticed a long base64-encoded string. Once decoded and reorganized, it contained several .webp images with unusual names like 1991781613.webp, 1273827392.webp, etc.

Checking the source code:

We understand that filenames are generated using Python’s getrandbits(32), which produces 32 random bits via the random.getrandbits function.

The interesting point here is that this function uses the Mersenne Twister generator, a PRNG (Pseudo-Random Number Generator) that is not cryptographically secure.

RootMeCTF-20K - WEB-TraineeTrainee

Mon, 12 May 2025 00:00:00 +0000

Description:

The trainee made a weird commit that’s flooding the server with requests—and eventually blocking connections. We’re hinted that something strange is lurking in their Nginx setup.

As soon as we connect we have a file reader form. I stared with a whatweb

With this we know the backend runs a Nginx 1.24.0. I tried to research for a file like a file.txt, example.txt localhost and /etc/nginx because of what could be a nginx misconfiguration.

THCon - Crypto

Tue, 08 Apr 2025 00:00:00 +0000

Overview of the Challenge Link to heading

In this challenge we are given a Python script that performs a one-time pad (OTP) encryption on a file and a crypted file.

Here’s what happens:

1.OTP Generation: Link to heading

A 10-byte pad is generated using random bytes.

def generate_OTP():
 OTP = b''
 for _ in range(10):
 # Generates a random byte (0–255) and appends it to the OTP.
 OTP += int.to_bytes(randint(0,255), 1, 'big')
 return OTP

2.File Encryption: Link to heading

The script reads the input file in binary mode and encrypts it by XORing each byte with a corresponding byte from the OTP (repeating the OTP cyclically).

LA-CTF - I spy...

Mon, 10 Feb 2025 00:00:00 +0000

Challenge Description Link to heading

In this challenge, there is a form where we must submit tokens. The description and hints indicate that multiple tokens are hidden in different parts of the web application. The objective is to find and submit all the tokens to obtain the flag.

Step 1: Understand Where to Look for Tokens Link to heading

Tokens are scattered across several common locations where hidden data may reside:

LA-CTF - Lucky flag

Mon, 10 Feb 2025 00:00:00 +0000

Challenge Description Link to heading

In this challenge, I was presented with a web page filled with thousands of buttons, all labeled “flag”.

The goal was to find the correct button that reveals the flag.

Step 1: Inspecting the Source Code Link to heading

Instead of clicking every single button, I looked into the main.js file which controls the behavior of the buttons.

Nullcon-Goa-HackIM-2025 - Web

Mon, 10 Feb 2025 00:00:00 +0000

Web Challenge - CRC Hash Collision Exploit Link to heading

Challenge Description Link to heading

In this challenge, we are provided with the source code of a PHP script along with two hints:

Hint 1: PHP documentation link for crc32()
Hint 2: A PHP CRC8 implementation

The goal is to retrieve the flag by bypassing an authentication mechanism based on CRC hashes.

Huntress-CTF - DontBelieveEverythingOnTheInternet

Fri, 01 Nov 2024 00:00:00 +0000

Don't believe everything you see on the Internet! 
 
Anyway, have you heard this intro soundtrack from Half-Life 3?

The challenge starts by downloading an .mp3 file. While trying to process it in Python to extract metadata, I encountered errors. After several attempts, I started to wonder if it was actually an MP3 file—or something else. I wrote a function to determine the real file type:

import filetype

def check_file_type(filename): 
 kind = filetype.guess(filename) 
 if kind is None: 
 return "unknown file type." 
 return f"type: {kind.mime}, extension: {kind.extension}"

filename = 'src/Half-Life_3_OST.mp3' 
print(check_file_type(filename))

Thanks to this script, I found out that the file was actually a PNG:

HeroCTF - DataScience

Mon, 28 Oct 2024 00:00:00 +0000

In this challenge, we had to sort data and calculate specific values. After several attempts, I arrived at the following code:

import pandas as pd 
import math 

df = pd.read_csv("orders.csv", parse_dates=["date"]) 

df = df[df["date"] < "2023-01-01"] 

initial_balance = 10000 
user_balances = {} 

unique_users = pd.concat([df["buyer_id"], df["seller_id"]]).unique() 
user_balances = {}
for user_id in unique_users:
 user_balances[user_id] = initial_balance

total_discount_spared = 0 

for _, row in df.iterrows(): 
 buyer_id = row["buyer_id"] 
 seller_id = row["seller_id"] 
 price = row["price"] 
 discount = row["discount"] 

 discounted_price = price * (1 - discount / 100) 
 amount_spared = price - discounted_price 
 total_discount_spared += amount_spared 

 user_balances[buyer_id] -= discounted_price 
 user_balances[seller_id] += discounted_price 

# resp 1 
richest_user = max(user_balances, key=user_balances.get) 

# resp 2 
total_discount_spared = math.floor(total_discount_spared) 

# resp 3 
negative_balance_count = 0
for balance in user_balances.values():
 if balance < 0:
 negative_balance_count += 1

#print the flag 
flag = f"Hero{{{richest_user}_{total_discount_spared}_{negative_balance_count}}}" 
print(flag)

Hero{732669_188098001_3468}