CTF WRITEUPS
How each chain actually went: the dead ends, the working exploit, the flag.
// Filter by Category
Three bugs to forge an admin token
A hand-rolled TCP proxy with a parser differential, an SSRF that leaks the JWKS, and a JWT verifier that trusts the token to name its own algorithm.
AKASEC CTFThe proxy that wasn't a proxy
A DFIR challenge with 50,000 SIEM logs and no host artifacts. The rogue container names itself, and the flag is hiding in HTTP response sizes.
AKASEC CTFSSRF into a preg_replace /e that shouldn't exist
A PHP box that only validates one of two parameters, an SSRF to an internal server running preg_replace with the /e modifier, and a function blocklist that forgot glob.
AKASEC CTFFlask SSTI to RCE
Brute-forced a weak Flask session secret to forge an authorized session, then abused Jinja2 SSTI in the checkout name field to land a reverse shell and read the flag.
Halborn Security AssessmentCSP Bypass → Internal SSRF
Injected a meta-refresh into a Puppeteer-rendered page head to slip past its CSP and SSRF the internal /secret endpoint via an <object> element, dodging X-Frame-Options.
Halborn Security AssessmentNote: Writeups with a full walkthrough are clickable. The rest are challenges I solved without a published writeup.