Category
Security
6 posts
Read the file with lxml.etree that Vulnerable to XXE, include the local DTD, and generate an error to read the Flag: Cyber Jawara National 2025 Quals SVG Validator
A simple SVG validator.In order to gain Arbitrary File Read, we will exploit the XXE vulnerability in the lxml.etree. We must introduce an error in the XML since we cannot read the flag information di...
Exploiting DOM Clobbering and Using Trigram CSS Leak to Expose Nonce: Freedom Notes - Cyber Jawara National 2025 Quals Writeup
Make your notes has freedom, a freedom from sanitizerIn this challenge, we will exploit two vulnerabilities to gain XSS. The first is DOM Clobbering in the sanitize function in the index.html file, wh...
Bypassing null Origin in 4xx Status Code Using Iframe | disconnection-revenge Writeup | AlpacaHack Round 7 (Web)
Unfortunately, I solved this challenge only 30 minutes after the CTF ended. Here is my write-up about the challenge.This is a fixed challenge of disconnection.In this challenge, we are given source co...
Exploiting Race Condition To Gain Infinity Wealth - m0leCon CTF 2023 - goldinospizza2
In the m0leCon CTF 2023, I participated with team TCP1P and successfully solved several web challenges.In this article, I will provide a write-up about an intriguing challenge named "goldinospizza2."...
Exploiting the Latest Render Engine in Node (EJS) - SEETF 2023 - Express JavaScript Write-up
During SEETF 2023, I participated as a member of the TCP1P team and successfully solved several web challenges.In this article, I will provide a write-up for a specific challenge called "Express JavaS...