CTF write‑ups, CVEs and Bug Bounty findings
One zero-byte QUIC packet is enough to desynchronize HAProxy's backend connection pool and smuggle HTTP requests across unrelated users — even users on a completely different frontend protocol.
Deep dive into a TOCTOU vulnerability in Node.js's ClientRequest.path that bypasses CRLF validation and enables Header Injection and HTTP Request Splitting across 7+ major HTTP libraries totaling 160M+ weekly downloads.
How a single-use OTP flow token not bound to the correct subject enabled a zero‑click account takeover.
A chain of issues in listmonk allows a Cross‑Site Request Forgery (CSRF) to trigger arbitrary JavaScript execution (XSS) in the admin’s browser, culminating in a full admin account takeover
From the classic “quote break” in a to a login takeover: step by step, I show how a “low-impact” RXSS becomes a real credential stealer.
In this post, I break down three real-world vulnerabilities found in WordPress plugins — from unsafe deserialization to arbitrary file upload — and show how they can lead to full compromise.Includes analysis, PoCs, and exploitation details.
Writeups of some challenges from UTCTF 2024
In this post I detail two critical security flaws I discovered last year in the Znuny / OTRS ticket-ing system: a path-traversal file-upload bug that can be leveraged for remote code execution, and a Second Order SQL injection in the draft-form cleanup routine. The write-up walks through root cause analysis, step-by-step PoCs, impact, official patches, and mitigation tips for administrators who…
Writeups of some XSS challenges from CodeInTheDark CTF