Web
Posts with this tag
Posts
-
The CSC 2026 Payslip Portal: Three Bugs Where the File You Can Write Is the File You Run
Part two of the CSC 2026 finals. After the ransomware recovery came the attack-and-defence round, and one service fell to a chain of three — an unauthenticated CBC cookie became a padding oracle that forged an HR role, an HR-only template preview handed the live PDF generator to a Go template and turned it into a file write, and that file write landed on the one Go source the service re-interprets on every payslip.
-
ABN Gallery: The Host a Checker Reads and the Host a Socket Dials
A write-up of the web challenge ABN Gallery from DreamHack CTF Season 7, where a hand-written host extractor and the runtime's own URL parser disagree about what "0" means, and that one character of disagreement turns an SSRF guard into a path traversal on the flag.
