L3akCTF 2026 - Squid
A complex server-side web challenge showing off some parser differentials and a new technique. It was followed by a really interesting race condition technique involving file descriptors to read environment variables in Flask.
Blog | Jorian Woltjer
A blog with cybersecurity-related articles. Writeups of challenges in Capture The Flag (CTF) events, stories about hacking and guides with code examples and detailed explanations.
Latest posts
Finding XSS on Shazzer (literally)
How I found an XSS in Shazzer, a tool for discovering and sharing browser quirks through fuzzing. Not *using*, but *in* Shazzer. We'll explore some useful techniques with Blob URLs to unsandbox malicious content.
Roundcube XSS chained with cookie tossing for full inbox access
The agents found a Stored Self-XSS vulnerability that could really only be exploited with Cookie Tossing. Scary for password reset tokens...
Multiple XSS Vulnerabilities in Mailcow
A critical unauthenticated XSS, and another interesting Self-XSS escalation involving a Login CSRF with a leftover tab
Astro Full-Read SSRF via Host Header Injection
A framework-level vulnerability in Astro found by AI. Directly accessible servers could be used to fetch any internal resources with SSRF by a malicious Host header and some redirects.
SvelteSpill: A Cache Deception Bug in SvelteKit + Vercel
How an AI agent found a cache deception vulnerability affecting default SvelteKit apps deployed on Vercel. Authenticated responses could be cached and exposed across users.
hxpCTF 2025 - CatGPT
The hardest web challenge during 39C3's hxp CTF. Auditing RegExes in a PHP library to uncover small gadgets that allow escaping and fixing a JavaScript context.
Intigriti December XSS Challenge (1225)
A unique 6-part challenge by @Renwa containing many interesting techniques that combine into one large exploit. Learn some HTML/JavaScript quirks, an XS-Leak and how to minimize user interaction
openECSC 2025 - kittychat-secure
Overcomplicating a hard client-side web challenge involving complex CSP script gadgets. Exploit Math.random() predictability, and learn how to use the Connection Pool to make Race Conditions easier.
Exploiting Web Worker XSS with Blobs
Ways to turn XSS in a Web Worker into full XSS, covering known tricks and a new generic exploit using Blob URLs with the Drag and Drop API