Web

Open WebUI 0.3.8 issues session cookies without the Secure flag and with SameSite set to Lax, which lets a low-privileged attacker carry out a session fixation attack.

A link-checker with a local SSRF, reachable at 127.0.0.1:5000/flag. Non-deterministic and not dockerized, the most disliked challenge of the event.

A CSRF/XSS challenge masquerading as SSTI. A script tag on the admin page exfiltrated the bot cookie. First blood.

An exposed Firebase database. The flag was stored as a linked list of characters, each node carrying a computed expression for the next index.

A REST API endpoint and the web UI of Cisco NDFC are vulnerable to SQL injection, letting an authenticated read-only user read, modify, or delete arbitrary data.

A recursive merge on user-controlled ticket JSON allowed prototype pollution, setting admin to reach the admin page.

A web chain: a controllable hash function weakened the nonce, with XSS and a CSRF exfil on top.

A SQL injection login bypass opened a recon trail of hidden directories, DB creds, and a riddle pointing at combining encoded values into a PDF. Co-worked with ZyWAC.