Web

The session token was the user record XOR a secret key, so flipping one bit of ciphertext flipped the UID to 0 without ever recovering the key.

SSTI leaked the values needed to forge a JWT, and pyjwt’s default algorithm set let the public key double as an HMAC secret.

A loose nginx proxy_pass in front of a Ruby Sinatra app leaked the upstream hostname, which was the flag.

The picker fed user input through a shell, so a short reverse shell over an ngrok tunnel gave a session and the flag.

Path normalization let me reach the application source behind nginx, and the Dockerfile carried the flag as an environment variable.

The Out-of-Band Plug and Play feature of Cisco NDFC lets an unauthenticated, remote attacker read arbitrary files from the PnP container via improper path validation.