Crypto

Password reset tokens came from Apache Commons RandomStringUtils on a seeded java.util.Random, so observed tokens recovered the state and predicted the admin reset token.

A directory brute force found a transfer endpoint with a password-protected zip. Cracking it gave a CSV whose four encoded passwords were each their own mini challenge.

Insufficient SSH host key validation in Cisco NDFC lets an unauthenticated, on-path attacker impersonate NDFC-managed devices.

The session token was the user record XOR a secret key, so flipping one bit of ciphertext flipped the UID to 0 without ever recovering the key.

The JWT signing secret was exposed, so I forged a token that smuggled an eval payload into the username array.

A raw TCP service handed out a TLS key and cert, mutual TLS opened a shell, and layered encoding plus CrackStation gave root.