Home
Blog CTF Work Ivy.
root@kali:~# _

CTF WRITEUPS

How each chain actually went: the dead ends, the working exploit, the flag.

// Filter by Category

web hard 2025-10-19

Three bugs to forge an admin token

A hand-rolled TCP proxy with a parser differential, an SSRF that leaks the JWKS, and a JWT verifier that trusts the token to name its own algorithm.

AKASEC CTF
pwned
forensics hard 2025-10-19

The proxy that wasn't a proxy

A DFIR challenge with 50,000 SIEM logs and no host artifacts. The rogue container names itself, and the flag is hiding in HTTP response sizes.

AKASEC CTF
pwned
web hard 2025-10-18

SSRF into a preg_replace /e that shouldn't exist

A PHP box that only validates one of two parameters, an SSRF to an internal server running preg_replace with the /e modifier, and a function blocklist that forgot glob.

AKASEC CTF
pwned
web hard 2024-01-03

Flask SSTI to RCE

Brute-forced a weak Flask session secret to forge an authorized session, then abused Jinja2 SSTI in the checkout name field to land a reverse shell and read the flag.

Halborn Security Assessment
pwned
web hard 2024-01-03

CSP Bypass → Internal SSRF

Injected a meta-refresh into a Puppeteer-rendered page head to slip past its CSP and SSRF the internal /secret endpoint via an <object> element, dodging X-Frame-Options.

Halborn Security Assessment
pwned

Note: Writeups with a full walkthrough are clickable. The rest are challenges I solved without a published writeup.