Recent content on sylvie
On December 3rd 2025, Meta disclosed CVE-2025-55182 which we dubbed react2shell, an unauthenticated RCE in React Server Components. In short, the Flight protocol failed to properly validate types, allowing the construction of arbitrary chunks and access to object prototypes (and therefore the functions on them). Several very well-written technical breakdowns of the vulnerable Flight code have…
Last weekend RITSEC hosted its annual CTF. I had the privilege of being the “Challenges Lead” for the event this year, so while I wasn’t directly in charge, I had broad authority over certain parts of the event, some ability to influence administrative decisions, and personally authored about a third of the 36 challenges we had. Several weeks before our CTF, I played DiceGang…
Competing with SLICES last weekend I helped win HITCON CTF. I spent a good chunk of the time during the event solving a fairly hard web challenge called IMGC0NV. I was the 3rd solve on it overall, and it had 5 solves total by the end of the CTF. The setup for the challenge was fairly simple. There’s an app.py that runs a Flask server, an index.html , and a readflag.c that gets compiled into…
In spite of my otherwise packed schedule, I managed to set aside some time this past weekend to play UMass CTF with my team L3ak. As a team we placed first, and I personally cleared out the entire web category, several from OSINT and misc, and two of the three hardware challenges. I had a lot of fun with a bunch of the challenges and chose four of my favorites to write about.
I won 5th place in LA CTF 2025 with my team. I found a handful of the challenges I solved pretty cool so I wrote up my solutions and process for them Prologue This was my favorite challenge from this event by far. The challenge only gave us a link to a Scratch project with the description “You can do this.” After opening the project and clicking play, I could see what appeared to be a…
This is based on corgo’s writeup explaining how the Kullback test can be useful for solving cryptography CTF challenges. I wrote this using WebAssembly, all of the calculations are performed locally in your browser. The source code can be found on my github . utf-8 hex base64 binary file choose file options max key length: ignore errors: show peak labels: peak threshold:
This past weekend I competed in the srdnlen CTF with my team L3ak . There were a handful of challenges that I found fun enough to warrant a writeup, so here goes Cheese with Friends Cheese with Friends tells the story of what I can only assume was an LLM’s imagined experiences with Casu Martzu, a particularly gross variety of cheese from Sardinia, the home region of the team hosting this…
Last weekend my team and I competed in UofTCTF 2025 , where we placed 9th overall. I found one of the reversing challenges really interesting, and I was proud of my solution and solve process, so I made a writeup for it. Bloatware For this challenge we’re given a flag checker program, chal.js . Upon opening it I quickly saw that it was obfuscated with obfuscator.io and then minified.…
This October, Huntress ran a month-long CTF with challenges releasing every day. It was a team event, but participated solo. I ended up in overall 7th place. I wrote up my solutions to a small selection of my favorites. Base-p- Here we’re given a file called based.txt that contains the following content…
Since last summer, my main hobby project has been developing my reverse engineering skills by tearing apart Pokémon GO and seeing what I could learn. I’ve played this game since it was released in 2016 (when I was 11), and it’s been a fairly major part of my life since then. Last July I started by setting up a fairly basic PoGo map, as I described in an earlier blog post. This didn’t require any…
Since the introduction of lucky trades in Pokemon GO, there has been an obscure mechanic known as “Guaranteed Lucky Trades” that not many people understand. This is different from “Lucky Friends”, and the game gives no indication ahead of time as to whether or not a trade will be a Guaranteed Lucky Trade (GLT). In a recent blog post , Niantic announced that they were increasing the GLT cap from 15…
This weekend I participated in the 2023 RIT Women in Cybersecurity CTF challenge. Overall it was pretty fun, and I ended up coming in first place, winning the grand prize of a new wireless mechanical keyboard 😎. There were a lot of challenges, some good and some less good, but I picked five of my favorites to share. Intergalactic Disco Octopus Rave This was the first challenge I looked at. It…
Introduction Over the past few months, I’ve been working on developing a system to scan and map Pokémon GO spawns (among other things) for my local community. I don’t play enough to really take advantage of it myself, but hopefully others find it useful. My true goals here were twofold: Gain experience developing computer programs, reverse engineering, and networking If it works, potentially gain…
Prototyping For our Worlds robot, we wanted to move back to a flywheel design after running into some issues with our slingshot. We started by looking at what some other teams had done and decided to base our designs on that. We started by building on the old copy of our chassis we still had laying around, so we could know if this was going to work before we completely dismantled our robot from…
This is our team’s engineering notebook as of States 2023. We declined to update it further after this.
Doom on the V5 has existed for around 5 years at this point, I believe the original project was by sealj553 . This original port of doom to the V5 required both an SD card, and was also limited by the existence of the program bar which takes up 32 pixels at the top of the brain’s screen. My version is the original modified to run into neither of these challenges. For what should be obvious…
V5 Addrled VEXos 1.1.2 introduced a new ability to control WS2812B addressable LED strips directly from the ADI on the V5. Previously this was semi-possible by bit-banging with APA102C strips, but the speed at which the V5 could send data to the lights was far too slow to be workable in any real application. User code, that being the code that runs on CPU1, is limited to updating the state of the…
After reffing at my fair share of VEX tournaments in recent years, I’ve come to determine that I’m really not a fan of the web interface that is used to start/stop the match timers. Holding a phone or tablet like that in my hand for a long period of time is very bothersome to me and I wanted to design a better solution that would make the experience more bearable :3
Features Easy WS2812B Addressable LED control Accurate motor velocity measurements Template for making custom velocity controllers Many kinds of pre-built filters for general use Platform-agnostic, meaning it works with both PROS and VEXcode Installation PROS Download the latest version of the Sylib template from the Releases page In the directory where you downloaded the zip archive, run pros c…
haiiii, i’m sylvie. im 21 years old and study cybersecurity at RIT. mrowwww. sy1vi3 sylvie.fyi @sylvie.fyi ~sy1vi3 @_sy1vi3 Sylvie Mayer me@sylvie.fyi
cosmog my own fully custom pokemon go client compatible with other public tools for making maps of the game it runs natively on android and can be dockerized on arm-based systems allows many concurrent login sessions for optimized mapping closed-source and includes safeguards to prevent abuse, but i made it available for free! l3ak im part of the l3ak ctf team we were ranked 21st globally on…