Tag: Web (31 posts)

Approve Please, Genie!

CSS injection and browser side-channel exfiltration leak the flag from the approval bot.

CTF Web CSS Injection Side Channel PTITCTF

B

Brain Rot

Vite CVE-2025-30208 bypasses the dev server allow list and exposes arbitrary files through /@fs/.

CTF Web Vite CVE-2025-30208 PTITCTF

Đ

Độ Mixi

DOM Clobbering bypasses the sanitizer and enables file-name disclosure followed by flag read.

CTF Web DOM Clobbering Local File Read PTITCTF

L

LEMON MELON COOKIE

Client-side privilege escalation and SQL injection lead to the administrator account and flag.

CTF Web SQL Injection Privilege Escalation PTITCTF

M

Machine Love

Double URL encoding bypasses an absolute-path filter and enables local file read.

CTF Web Path Traversal Local File Read PTITCTF

P

Palworld Mod

Path traversal in the mod build flow writes a Python codec payload and reaches server-side code execution.

CTF Web Path Traversal RCE PTITCTF

P

PTIT Portfolio Renderer

Jinja2 SSTI bypasses a blacklist, reaches RCE, and reads the challenge flag.

CTF Web SSTI RCE PTITCTF

OmniCTF 2026

OmniCTF2026-web/Ganzir

CTF writeup - web/Ganzir (OmniCTF 2026)

CTF Web OmniCTF

OmniCTF 2026

OmniCTF2026-web/StayWild

CTF writeup - web/StayWild (OmniCTF 2026)

CTF Web OmniCTF

SekaiCTF 2026

SekaiCTF2026-web_<_w+

CTF writeup - web_<_w+ (SekaiCTF 2026)

CTF Web SekaiCTF

SekaiCTF 2026

SekaiCTF2026-web/migurimental

CTF writeup - web/migurimental (SekaiCTF 2026)

CTF Web SekaiCTF

GPNCTF2026-cookoff

CTF writeup - cookoff (GPNCTF 2026)

GPNCTF2026-Fancy Food Notifications

CTF writeup - Fancy Food Notifications (GPNCTF 2026)

GPNCTF2026-Pharry

CTF writeup - Pharry (GPNCTF 2026)

GPNCTF2026-recipeloader

CTF writeup - recipeloader (GPNCTF 2026)

GPNCTF2026-restaurant-builder

CTF writeup - restaurant-builder (GPNCTF 2026)

GPNCTF2026-SecretPickle

CTF writeup - SecretPickle (GPNCTF 2026)

GPNCTF2026-Secure Secretpickle

CTF writeup - Secure Secretpickle (GPNCTF 2026)

GPNCTF2026-Simple food notifications

CTF writeup - Simple food notifications (GPNCTF 2026)

TJCTF2026-web/chained

CTF writeup - web/chained (TJCTF 2026)

TJCTF2026-web/free-cloud-storage

CTF writeup - web/free-cloud-storage (TJCTF 2026)

TJCTF2026-web/paper-trail

CTF writeup - web/paper-trail (TJCTF 2026)

TJCTF2026-web/treasure-hunt

CTF writeup - web/treasure-hunt (TJCTF 2026)

TJCTF2026-web/Vibed Intranet Part 1&2

CTF writeup - web/Vibed Intranet Part 1&2 (TJCTF 2026)

TJCTF2026-web/vibecoded

CTF writeup - web/vibecoded (TJCTF 2026)

UMassCTF 2026

UMassCTF2026-Brick by Brick

CTF writeup - Brick by Brick (UMassCTF 2026)

CTF Web UMassCTF

UMassCTF 2026

UMassCTF2026-BrOWSER BOSS FIGHT

CTF writeup - BrOWSER BOSS FIGHT (UMassCTF 2026)

CTF Web UMassCTF

UMassCTF 2026

UMassCTF2026-ORDER66

CTF writeup - ORDER66 (UMassCTF 2026)

CTF Web UMassCTF

UTCTF 2026

UTCTF2026-Break the Bank

CTF writeup - Break the Bank (UTCTF 2026)

CTF Web UTCTF

UTCTF 2026

UTCTF2026-Crab Mentality

CTF writeup - Crab Mentality (UTCTF 2026)

CTF Web UTCTF

UTCTF 2026

UTCTF2026-Time to Pretend

CTF writeup - Time to Pretend (UTCTF 2026)