HackerDNA

CTF writeup for NexaTech Solutions: bypassing a login with a UNION-based MySQL injection, turning it into RCE by writing a PHP webshell with INTO OUTFILE to grab the user flag, then escalating to root by overwriting a world-writable supervisord.cron script that cron runs as root to read the root flag.

CTF writeup exploiting a server-side request forgery in a link preview service to reach the AWS instance metadata endpoint, retrieve IAM credentials, and use them to read the root flag from an internal control-plane API.

CTF writeup bypassing the SQL Injection Test Lab login with an OR 1=1 limit 1 payload against a real SQLite backend to retrieve the flag.

CTF writeup static-analyzing an ARM64 aarch64 license activation client, XOR-decoding an embedded encrypted flag from g_token_enc, reverse-engineering derive_key to forge the admin license, and activating an admin account to receive the root flag.

CTF writeup exploiting unauthenticated OS command injection in the ping parameter of a Flask Network Monitoring Tool to read the flag as root.

CTF writeup exploiting path traversal in an Apache 2.4.49 CGI file viewer to read flag.txt outside the web root via dot-dot-slash traversal.

CTF writeup building a custom wordlist from a game studio's own website to crack unsalted MD5 hashes from a leaked forum export, using password reuse to reach the internal portal and a protected vault.zip, then zip2john to open the final archive.

CTF writeup exploiting a Sanity headless CMS mock: retrieving unpublished draft posts via GROQ, mining the document transaction log for a deleted briefing, recovering its historical revision with an embedded API token, and using the token to access a separate internal dataset that leaks a launch briefing containing the root flag.

CTF writeup analyzing Apache access logs to identify a successful scanner probe that exfiltrated a backup.txt containing the flag, then accessing the recovered file.

CTF writeup cracking an HS256 JWT secret from rockyou to forge an admin token, leaking SSH credentials from the admin page, then escalating to root by injecting commands into a world-writable log file that a cron job evals.

CTF writeup for MediTrack Health: exploiting a Host header vulnerability in the password reset flow to take over the admin account, leaking the full reset token from an exposed mail-log by shortening the Host header, then achieving root via a misconfigured NOPASSWD sudo find in a ping-tool command injection.

CTF writeup defeating a SecureVault access control system whose credentials and flag are hardcoded in obfuscated client-side JavaScript, reversed with byte decoding.

CTF writeup bypassing the Enterprise Authentication System login with a classic SQL injection OR 1=1 payload to authenticate as admin on an Express-based auth service.

CTF writeup exploiting Python pickle deserialization vulnerability in a Flask app to achieve RCE, then escalating privileges via a sudo-allowed backup script.

CTF writeup exploiting a GetSimple CMS 3.3.16 info disclosure to extract admin credentials, then RCE via theme editor webshell and privesc with sudo find.

CTF writeup exploiting default admin:admin credentials on Apache Tomcat 9.0.96 Manager to deploy a WAR file for RCE, then privesc via sudo find.

CTF writeup exploiting SQL injection in a Flask app to reach an admin dashboard, then using the Werkzeug debugger console for root RCE.

CTF writeup exploiting an exposed .git directory to recover leaked SSH credentials, then privesc via Python module hijacking with sudo.

AlVault CTF writeup — exploiting a hidden grep-based search tool to extract SSH credentials, then privesc via os.system() command injection.