Web

A mutation-XSS that looked like a DOMPurify bug but was really a server-side String.replace breakout, plus an iframe and a cookie-scope trick to read a flag cookie scoped to a path …

Sample CTF writeup demonstrating the layout. Delete or replace it with a real one.

A Windows DC: SMB null session leaked a password-protected Office doc, cracking it gave CMS creds, a C1 CMS .NET deserialization bug gave RCE, and BloodHound pointed at a …

A blog rendered user quotes through the Jinja |safe filter and had an admin bot visit them, so a stored XSS payload leaked the bot cookie.

An XSS bot with no filtering at all — a bare alert(1) popped it.

A protobuf-based auth scheme defeated in three steps, an over-permissive registration, a length-truncating rename, and a score endpoint used as a parsing oracle.

The password check returned as soon as a character was wrong, so response time leaked the password one character at a time.

A URL fetcher checked that the host was not internal, then fetched it, so a DNS rebind flipped the name to localhost between the two steps.

Admin creds from the database, command injection in the add-customer form for a shell, then a SUID find for root.

An exposed Jupyter server on port 8888. A notebook is a code-execution primitive by design.