Latest

A complete writeup of the BlackHat 2025 crypto CTF challenges, including Hatagawa-II and Whack-A-Scratch. We break custom cryptographic schemes and reverse engineering puzzles to recover flags, with detailed analysis.

Exploiting a GraphQL vulnerability through SQL injection to bypass authentication and gain unauthorized access. By manipulating the JWT token, we set flagOwner to true and retrieve the flag.

Exploiting path traversal in a tar file extraction process to overwrite a rendered template, leading to Server-Side Template Injection (SSTI) and ultimately achieving Remote Code Execution (RCE)

Exploiting a path traversal vulnerability to upload a malicious file, leveraged local file inclusion (LFI) to execute it, used Server-Side Template Injection (SSTI) to gain Remote Code Execution (RCE), and ultimately located and read the flag from the server.

Retrieving data from SQLite3 database by exploiting Blind SQl injection in Web Application