HI Cyber Con 2026 CTF – Stillwell Estates Challenge Writeup
Stillwell Estates is a web exploitation challenge built around a real-estate agency’s listing import workflow. The agent portal accepts a Brotli-compressed JSON export and previews both property data and attached documents before publication. A document name supplied inside that export reaches a server-side file read. By understanding how the server resolves that name, we can…
HI Cyber Con 2026 CTF – Ghost in the Wire Challenge Writeup
Ghost in the Wire is a network forensics challenge built around a small packet capture. The task is to distinguish routine-looking ICMP Echo Requests from a second flow that carries a message one byte at a time. This writeup starts from the supplied archive, inspects the packet metadata, isolates the unusual flow, orders its payloads…
HI Cyber Con 2026 CTF – Project Mangoo Challenge Writeup
Project Mangoo is a Windows x64 console program presented as a network gateway for operators. A client first receives a fresh 32-byte challenge and must answer with a 32-byte authorization token before it can use the gateway menu. The token is derived from the displayed challenge by a reversible byte transformation, so the first barrier…
HI Cyber Con 2026 CTF – File Viewer Challenge Writeup
File Viewer is a blackbox web challenge built around a small ZIP inspection service. A visitor uploads an archive, receives a page listing its members, and can open each listed file through the application. The security boundary is therefore the boundary between untrusted archive content and files the server is allowed to read. In this…
HI Cyber Con 2026 CTF – Ouroboros Challenge Writeup
Ouroboros is a blackbox web challenge built around a small report builder. A user can sign in, save a JSON branding configuration, and request a preview rendered from a fixed server-side template. The challenge states that the flag is stored on disk and has no HTTP route. That makes a server-side file read, or code…
Hack The Box – Dark Embargo Challenge Writeup
Dark Embargo is a web exploitation challenge built around a stock PHP 8.4.26 Apache image and the publicly known vuln “PHP2Shell” CVE-2026-109618 / CVE-2026-109619. Its public page is static HTML, yet Apache still passes requests for index.php through PHP. Multipart parsing and session upload progress therefore run before the page content matters. This writeup traces…
FortID CTF 2026 – GDB SaaS Challenge Writeup
GDB SaaS is a file disclosure challenge disguised as a free disassembly service. The server accepts a base64-encoded ELF file, copies the flag into a temporary directory beside that file, and returns GNU Debugger (GDB) output for a requested function. The solution does not run the uploaded program, corrupt memory, or inject a shell command.…
Securinets CTF Quals 2026 – Nyoom Challenge Writeup
Nyoom is a web challenge built from an Express application, a Varnish reverse proxy, and an automated administrator browser. Users can create an account, write a profile bio, and report a dashboard URL for the administrator to visit. The administrator’s session cookie is deliberately set to the flag. Solving the challenge therefore means making the…
FortID CTF 2026 – String Peek and Poke Challenge Writeup
String Peek and Poke is a Linux x86-64 pwn challenge built around a small C++ note program. A user can store a word in one of eight std::string slots, retrieve a slot, or exit. Both note commands accept a signed index without checking whether it lies between 0 and 7. That single mistake lets an…
FortID CTF 2026 – DESBox Challenge Writeup
DESBox is a source-aided cryptography challenge presented as a small MS-DOS-like shell. Its KEYB command accepts two 24-byte keys, randomly rearranges the bytes of each key, XORs both with the same secret mask, and then uses the resulting keys for two different 3DES operations: encrypting the hidden flag and decrypting one attacker-supplied ciphertext. The intended…
👾 BREAKIN’ Systems WITH Rootrunners
API Application Security Arbitrary File Read Authentication Bypass Binary Analysis Binary Exploitation Buffer Overflow Bypass Crypto curl CyberSecurity Decryption Docker ELF Encoding Encryption Endpoint Eschaton CTF 2026 Ethical Hacking Exploit Flask Forensics Function Ghidra HackTheBox HTML Information Disclosure Input Validation JavaScript JSON JWT Key Misc OWASP OWASP Top 10 Path Traversal payload Penetration Testing PHP PHP security Privilege Escalation Pwn pwntools Python RCE Remote Code Execution Reverse Engineering Reversing secure coding Security Research Server-Side Template Injection Shell SQLi SQL Injection SSTI Stack Buffer Overflow Web Web Application Security Web Exploitation Web Security XOR