Sau

Hack The Box. Linux. Easy machine

6 minutes to read

This machine has a web application that is vulnerable to SSRF, which can be used to read the contents of an internal server, which is vulnerable to command injection. The two vulnerabilities can be chained to get RCE on the machine. The low-privileged user is able to run systemctl as root using sudo, which leads to the privilege escalation via the default pager less

Antidote

Hack The Box. Challenges. Pwn

14 minutes to read

ARM 32-bit binary. Buffer Overflow. Ret2csu. Ret2Libc

CurlAsAService

Hack The Box. Challenges. Web

2 minutes to read

Parameter injection. Local File Read

E.Tree

Hack The Box. Challenges. Web

3 minutes to read

XPATH injection. Automate flag extraction

emoji voting

Hack The Box. Challenges. Web

5 minutes to read

Boolean-based SQLi in ORDER. Automate flag extraction

Lazy Ballot

Hack The Box. Challenges. Web

3 minutes to read

CouchDB. NoSQL injection. Authentication bypass

Toxic

Hack The Box. Challenges. Web

5 minutes to read

PHP deserialization. Local File Inclusion. Log Poisoning

Watersnake

Hack The Box. Challenges. Web

4 minutes to read

Java. CVE. SnakeYAML insecure deserialization

Wild Goose Hunt

Hack The Box. Challenges. Web

3 minutes to read

MongoDB. NoSQL injection. Automate flag extraction

baby-talk

DiceCTF 2024 Quals

17 minutes to read

64-bit binary. Heap exploitation. Null-byte poison. Overlapping chunks. Tcache poisoning

funnylogin

DiceCTF 2024 Quals

3 minutes to read

SQLi. JavaScript object attributes

rps-casino

DiceCTF 2024 Quals

6 minutes to read

LFSR. Modular arithmetic. z3

winter

DiceCTF 2024 Quals

5 minutes to read

Winternitz One-Time Signature

yaonet

DiceCTF 2024 Quals

10 minutes to read

ECC. Baby-step, giant-step. Meet-in-the-middle