dimasc.tf — Blog & Notes

My-CTF-Challenges — Hard AI Benchmark (4873f89c)

noreply@dimasc.tf (Dimas Maulana) — Fri, 11 Sep 2026 00:10:00 GMT

The initial synchronized set contains three solved, four timed out, and one blocked record. After replacing the two withheld shortcut-affected baselines with repaired revisions, the current eligible s...

Rare Web CTF Challenges — 0–2 Solves

noreply@dimasc.tf (Dimas Maulana) — Thu, 10 Sep 2026 04:07:00 GMT

Checked 10 September 2026. Scope: difficult Web and browser-adjacent challenges for reference and candidate-primitive research.

TFC CTF 2026 — Under 20 Solves

noreply@dimasc.tf (Dimas Maulana) — Mon, 07 Sep 2026 06:33:00 GMT

Checked on 7 September 2026 (Asia/Makassar). Filter: strictly fewer than 20 solves, across all 29 challenges. Three challenges qualify; all are WEB.This is a research-status note. No matching solution...

Forensics

noreply@dimasc.tf (Dimas Maulana) — Mon, 08 Jun 2026 00:20:00 GMT

Flag: SAS{1_d1d_my_f1rst_add_5_when_1_w4s_7} (submit verbatim — the drawn image has no _ between a and dd_5)Flag: RTRTNI26{43.431, 39.933} — server-validated First Blood, 300 base points + 20 bonus.

Path Traversal

noreply@dimasc.tf (Dimas Maulana) — Wed, 08 Apr 2026 04:51:00 GMT

Pwn

noreply@dimasc.tf (Dimas Maulana) — Mon, 09 Mar 2026 22:29:00 GMT

Codex

noreply@dimasc.tf (Dimas Maulana) — Mon, 09 Mar 2026 08:34:00 GMT

YAML

noreply@dimasc.tf (Dimas Maulana) — Wed, 11 Feb 2026 08:06:00 GMT

The vulnerability stems from how YAML aliasing interacts with delayed data mutation.Initially, the validation loop checks conf["blogs"][0]["name"]. Later in the execution, the code applies a transform...

PatchStack CTF 2025: End-of-the-year Alliance Capture the Flag

noreply@dimasc.tf (Dimas Maulana) — Sun, 21 Dec 2025 12:21:00 GMT

The challenge involves a WordPress plugin named "AI Trust Score" (located in wp-content/plugins/ai-badbots/ai-badbots.php). This plugin uses AI heuristics to assign a "trust score" to incoming request...

GIT

noreply@dimasc.tf (Dimas Maulana) — Tue, 11 Nov 2025 03:54:00 GMT

ASIS CTF 2024git log to rce using textconvsolverASIS CTF Final 2024 - gitmails (web)

SAML

noreply@dimasc.tf (Dimas Maulana) — Tue, 11 Nov 2025 00:59:00 GMT

Unicode

noreply@dimasc.tf (Dimas Maulana) — Thu, 23 Oct 2025 02:01:00 GMT

Unicode trick we can input this to get single quote ȧ>

123

level js library injection because the code uses db to read/write post instead of dbPost.

Dangling Markup Attacks

noreply@dimasc.tf (Dimas Maulana) — Mon, 20 Oct 2025 02:52:00 GMT

CVE

noreply@dimasc.tf (Dimas Maulana) — Wed, 24 Sep 2025 03:54:00 GMT

CVE-2024-51417 is a vulnerability in System.Linq.Dynamic.Core that allows remote access to properties on reflection types and static properties/fields, leading to RCE.

Javascript

noreply@dimasc.tf (Dimas Maulana) — Fri, 12 Sep 2025 07:36:00 GMT

Bypass forbidden characters in Javascript when special characters are blacklisted.Forbidden Characters:Bypass Method 1: Using instanceof and array syntaxBypass Method 2: Using Symbol.hasInstanceWhen a...

Patchstack Aliance CTF S02E03 - WordCamp Europe

noreply@dimasc.tf (Dimas Maulana) — Sun, 08 Jun 2025 03:29:00 GMT

The endpoint /wp-json/ghostly/v1/login is a custom REST route in the WordPress backend. Here’s the kicker:Here’s the vulnerable PHP handler logic (as reverse-engineered from the behavior):This effecti...

SSRF

noreply@dimasc.tf (Dimas Maulana) — Mon, 02 Jun 2025 11:30:00 GMT

justctf 2023 https://gist.github.com/TrixterTheTux/99c1da88ebdc7bd3de224ef500f01178https://www.serv-u.com/resources/tutorial/pasv-response-epsv-port-pbsz-rein-ftp-command#:~:text=(p1%20*%20256)%20%2B%...

CSSLeak

noreply@dimasc.tf (Dimas Maulana) — Mon, 02 Jun 2025 11:27:00 GMT

paper: TLDR; Leaking CSS selectors without network exfiltration. I spent a lot of time trying to use crashing payloads but took too long, ended up being able to use the tag to count frames co...

XXE

noreply@dimasc.tf (Dimas Maulana) — Mon, 02 Jun 2025 11:25:00 GMT

https://mohemiv.com/all/evil-xml/https://github.com/zeyu2001/My-CTF-Challenges/tree/main/SEETF-2023/ezxxeTETCTF2022- transform2newyear & admin portalthis is the challenge i've made with <@268513122740...

Latex

noreply@dimasc.tf (Dimas Maulana) — Sat, 31 May 2025 04:13:00 GMT

SCTF 2024 By W&M - W&M Team

ja3

noreply@dimasc.tf (Dimas Maulana) — Sat, 31 May 2025 04:07:00 GMT

faking ja3 fingerprinthttps://balsnctf.com/challenges#0FA-23Route the runner took: it ruled out smuggling HTTP_SSL_JA3 as a request header from the module source (the add-on registers an explicit $htt...

Electron

noreply@dimasc.tf (Dimas Maulana) — Sat, 31 May 2025 04:06:00 GMT

https://github.com/maple3142/My-CTF-Challenges/blob/master/HITCON%20CTF%202023/Harmony/dist/client/electron/preload.tshttps://github.com/maple3142/My-CTF-Challenges/blob/master/HITCON%20CTF%202023/Har...

HTMX

noreply@dimasc.tf (Dimas Maulana) — Sat, 31 May 2025 04:05:00 GMT

![[Pasted image 20230620190834.png]]https://htmx.org/attributes/hx-disable/#:~:text=The%20hx%2Ddisable%20attribute%20will,to%20prevent%20malicious%20scripting%20attacks gpn ctf 2023ctf/2024/linectf/we...

DOM CLOBERING

noreply@dimasc.tf (Dimas Maulana) — Sat, 31 May 2025 04:04:00 GMT

this will createtested: firefox v102seccon quals 2023 “blink web”payloadsadly this technique will thor error if we don’t use something like this to wrap the document objectChallenges - Blue Water CTF...

Client Side Desync Attack

noreply@dimasc.tf (Dimas Maulana) — Sat, 31 May 2025 04:03:00 GMT

https://mizu.re/post/abusing-client-side-desync-on-werkzeughttps://github.com/zeyu2001/My-CTF-Challenges/tree/main/SEETF-2023/now-you-c-meSetup. 3 services in one net namespace: Node proxy:3000 (rever...

Curl

noreply@dimasc.tf (Dimas Maulana) — Sat, 31 May 2025 04:02:00 GMT

we can use like {} below to bypass blacklistin curl we can use -k option without any space to specify a curl config fileexample in htbctf 2024 challenge percetron https://trixterthetux.notion.site/HTB...

C

noreply@dimasc.tf (Dimas Maulana) — Sat, 31 May 2025 04:01:00 GMT

Redis

noreply@dimasc.tf (Dimas Maulana) — Tue, 27 May 2025 06:52:00 GMT

redis.Ring does not check what shards you access. redis.Del on several keys will execute only on the shard of the first key, which can lead to an inconsistent state where some keys exist for a deleted...

Puppetter / playwright

noreply@dimasc.tf (Dimas Maulana) — Mon, 05 May 2025 06:32:00 GMT

The challenge idea is based on finding this issue: https://github.com/puppeteer/puppeteer/issues/13840Unitended, use window.playwright__binding("foobar") for crashing the playwringt and do leak from t...

Python

noreply@dimasc.tf (Dimas Maulana) — Mon, 28 Apr 2025 09:35:00 GMT

payloadthats make the innerHTML is appended into non iframe tagfun fact yang easy bisa pakai ipv6 dan itu support scope id seperationhttps://github.com/python/cpython/blob/49fb75c676bd422b03aef9824d1...

Quic

noreply@dimasc.tf (Dimas Maulana) — Mon, 28 Apr 2025 09:10:00 GMT

let me put this challenge clearly for those who didnt got what actually is 0rtt replay attack so basically in tls 1.3, client sends a clienthello along with some ciphers to use then server acknowledge...

Pyjail

noreply@dimasc.tf (Dimas Maulana) — Tue, 22 Apr 2025 04:03:00 GMT

golfadvancedrestore builtinshttps://github.com/BYU-CSA/BYUCTF-2023/tree/main/builtins-2imaginary-ctf 2023https://peps.python.org/pep-0560/#:~:text=The idea of class_getitem is simple%3A it is,to avoid...

Elixir

noreply@dimasc.tf (Dimas Maulana) — Tue, 22 Apr 2025 03:47:00 GMT

BUN

noreply@dimasc.tf (Dimas Maulana) — Tue, 08 Apr 2025 14:32:00 GMT

BUN null injection ASIS CTF 2023ASIS CTF 2023for hello again: - find the /src:/[path] hardcoded endpoint in bun’s debug mode that launches an editor on the system (why is this enabled by default? wtf?...

gRPC

noreply@dimasc.tf (Dimas Maulana) — Thu, 27 Mar 2025 06:46:00 GMT

This only works locally because the server behaves differently. There are actually two types of identifiers from the package we send: one for the handler and one for the message type. To create type c...

Bypass

noreply@dimasc.tf (Dimas Maulana) — Thu, 27 Mar 2025 03:07:00 GMT

ZipSlip

noreply@dimasc.tf (Dimas Maulana) — Thu, 27 Mar 2025 02:39:00 GMT

vulnerable codewe can do this to gain arbitrary file writevulnerable codetar versiThe unzip logic is defined in the file ZipArchive.java:But oops, it looks like the zip file entries are not sanitised,...

Mongo

noreply@dimasc.tf (Dimas Maulana) — Mon, 17 Mar 2025 13:47:00 GMT

this mongo db version is vulnerable to log4jhttps://community.progress.com/s/article/blackduck-identified-vulnerability-with-mongodb#:~:text=BlackDuck%20identified%20vulnerability%20log4j%201.2.25%20i...

Dompurify

noreply@dimasc.tf (Dimas Maulana) — Mon, 17 Mar 2025 02:53:00 GMT

https://mizu.re/post/exploring-the-dompurify-library-hunting-for-misconfigurations#beforeSanitizeAttributes-manipulationThe solution for 🌱🌱 is mxss with transferring a style tag in xhtml namespace...

Cache Poisoning / Cache Probing

noreply@dimasc.tf (Dimas Maulana) — Fri, 14 Mar 2025 06:40:00 GMT

cache poisoning using request smuglingchunky unintended: GET /{user_id}/.well-known/jwks.json /../../..{post_url} server thinks its http/0.9 and it caches the response no transfer-encoding stuff neede...

DNS

noreply@dimasc.tf (Dimas Maulana) — Thu, 13 Mar 2025 10:33:00 GMT

localhost.7chn.me -> 127.0.0.1foobar.n.7chn.me -> your serverworking in selenium==4.27.1https://github.com/DownUnderCTF/Challenges_2023_Public/blob/main/misc/mini-dns-server/solve/solv.pyIt is to brin...

Java

noreply@dimasc.tf (Dimas Maulana) — Thu, 13 Mar 2025 00:52:00 GMT

us-18-Haken-Automated-Discovery-of-Deserialization-Gadget-Chains-wp.pdfcorlang: use this twice to get your karma > 10disconnect and reconnect${tokenRepo.findAll()[0].value} to get the flagAt this poin...

SQL

noreply@dimasc.tf (Dimas Maulana) — Wed, 12 Mar 2025 12:02:00 GMT

https://swisskyrepo.github.io/PayloadsAllTheThings/SQL Injection/PostgreSQL Injection/#postgresql-file-writeInstallations running Postgres 9.3 and above have functionality which allows for the superus...

Golang

noreply@dimasc.tf (Dimas Maulana) — Wed, 12 Mar 2025 10:26:00 GMT

err is shared between handler calls and therefore, we can race the checkPath call and the err != nil check.https://caddyserver.com/docs/modules/http.handlers.templateshttps://github.com/sohomdatta1/so...

Docker

noreply@dimasc.tf (Dimas Maulana) — Wed, 12 Mar 2025 08:22:00 GMT

l3hctf 2024https://s1um4i-official.feishu.cn/docx/QeGGdeyuhoR6kuxCOj8c44wRnne#SfxUd5lMRoxkfCx1G7HcrCTbnobdetailed WU can be see there https://hust-l3hsec.feishu.cn/docx/MZ8SdwSoPo3cBTxOxbGcuUBun4cln -...

Browser

noreply@dimasc.tf (Dimas Maulana) — Tue, 04 Mar 2025 04:28:00 GMT

the challenge use FROM node:16-alpine3.16 which bundle Chrome version 102, and can be used to gain RCE.CTFtime.org / Google Capture The Flag 2025 / Sourceless / WriteupNotice that the bot runs Chromiu...

nginx

noreply@dimasc.tf (Dimas Maulana) — Tue, 04 Mar 2025 04:23:00 GMT

You can do something like this to do path traversal echo -e “GET /%2f%2f/%2f%2f/%2f%2f/%2f%2f/%2f%2f/../../../../../../opt/flag.txt HTTP/1.1: centvps.centaurushook.xyz” | nc centvps.centaurushook.xyz...

Wordpress

noreply@dimasc.tf (Dimas Maulana) — Mon, 24 Feb 2025 10:25:00 GMT

un-authenticated admin endpoint/wp-admin/admin-post.phpwhereis_admin()returnstrueand still recommending EOL PHP 7.4 (https://wordpress.org/download/)WordPress Plugin Security Testing Cheat Sheet · wps...

Patchstack Alliance CTF S02E01 - WordCamp Asia

noreply@dimasc.tf (Dimas Maulana) — Sun, 23 Feb 2025 13:15:00 GMT

Last weekend, I participated in the Patchstack WCUS CTF and solved all the WordPress challenges. Here's my write-up for each challenge from the Patchstack WCUS CTF 2025.Using Semgrep and my Semgrep cu...

CSP Bypass

noreply@dimasc.tf (Dimas Maulana) — Sun, 16 Feb 2025 00:52:00 GMT

To avoid leaking path information cross-origin (as discussed in Egor Homakov’s Using Content-Security-Policy for Evil), the matching algorithm ignores the path component of a source expression if the...

CSRF

noreply@dimasc.tf (Dimas Maulana) — Fri, 14 Feb 2025 14:04:00 GMT

teknik solve lain untuk adminplz, pakai dns rebinding attack untuk bypass same-origin-policy(for adminplz) Thanks for the 0.0.0.0 tip. That worked for me! I host this page locally:and then submit a UR...

Bash

noreply@dimasc.tf (Dimas Maulana) — Mon, 10 Feb 2025 13:01:00 GMT

there’s some strange behaviour in bash version 5.0.3(1)-release (in version 5.2.26 doesn’t work) where array such as this will execute header_namethis is vulnerable too from kalmarctf 2024this works t...

SSTI

noreply@dimasc.tf (Dimas Maulana) — Mon, 10 Feb 2025 11:41:00 GMT

**Using MRO and subclasses to access subprocess.Popen:**This accesses the base object class via MRO, gets all subclasses, and uses index 399 (subprocess.Popen) to execute shell commands.AI writeup (co...

XSLeak

noreply@dimasc.tf (Dimas Maulana) — Mon, 10 Feb 2025 11:29:00 GMT

for ad-note I had a solution that was too slow but still interesting. By setting the attribute name=NAME, all ad iframes get the the name NAME, and reading on the window reference .NAME would return t...

React / NextJS / Svelte

noreply@dimasc.tf (Dimas Maulana) — Mon, 10 Feb 2025 08:58:00 GMT

You can only read valid json file exampleall you need is a file with //#sourceMappingURL= in it, and then the file you want to exfilitrate (it must be valid json though, which is why the dockerfile w...

Leak

noreply@dimasc.tf (Dimas Maulana) — Mon, 10 Feb 2025 06:43:00 GMT

https://gist.github.com/tyage/3bb2b730c67b363a26b45699ca34b22ahttps://hackmd.io/@r2dev2/S1P0RYHYke#WebNot sure if anyone else used this trick From the xs leak via cpu microarchitectual attack dream (e...

Node / JS

noreply@dimasc.tf (Dimas Maulana) — Mon, 10 Feb 2025 06:43:00 GMT

https://hackerone.com/reports/2819573Referensi dari sini:https://stackoverflow.com/questions/35949554/invoking-a-function-without-parenthesesCheck jawaban nomer 7https://github.com/daffainfo/ctf-write...

Crypto Web

noreply@dimasc.tf (Dimas Maulana) — Sun, 09 Feb 2025 22:53:00 GMT

pingCTF 20231753CTF ## ZerodayUntitled example program from TAMUCTF 2024exploittamuctf-2024/web/cracked at master · tamuctf/tamuctf-2024 (github.com)l34k CTF 2024AKASEC CTF 2024 | Rusty RoadsolverWrit...

PHP

noreply@dimasc.tf (Dimas Maulana) — Sun, 09 Feb 2025 07:57:00 GMT

Proxy / WAF Protections Bypass | hacktricksNginx FPM configuration:CopyNginx is configured to block access to /admin.php but it's possible to bypass this by accessing /admin.php/index.php.Copytl;dr ab...

XSS

noreply@dimasc.tf (Dimas Maulana) — Sat, 08 Feb 2025 18:30:00 GMT

localhost.7chn.me -> 127.0.0.1foobar.n.7chn.me -> your serveri was definitely wrong. The A=>B->A (we abuse this relationship to cache our payload and trigger XSS) is strictly considered same site (htt...

Read the file with lxml.etree that Vulnerable to XXE, include the local DTD, and generate an error to read the Flag: Cyber Jawara National 2025 Quals SVG Validator

noreply@dimasc.tf (Dimas Maulana) — Sun, 12 Jan 2025 10:59:00 GMT

A simple SVG validator.In order to gain Arbitrary File Read, we will exploit the XXE vulnerability in the lxml.etree. We must introduce an error in the XML since we cannot read the flag information di...

Exploiting DOM Clobbering and Using Trigram CSS Leak to Expose Nonce: Freedom Notes - Cyber Jawara National 2025 Quals Writeup

noreply@dimasc.tf (Dimas Maulana) — Sun, 12 Jan 2025 09:28:00 GMT

Make your notes has freedom, a freedom from sanitizerIn this challenge, we will exploit two vulnerabilities to gain XSS. The first is DOM Clobbering in the sanitize function in the index.html file, wh...

Bypassing null Origin in 4xx Status Code Using Iframe | disconnection-revenge Writeup | AlpacaHack Round 7 (Web)

noreply@dimasc.tf (Dimas Maulana) — Sat, 30 Nov 2024 11:42:00 GMT

Unfortunately, I solved this challenge only 30 minutes after the CTF ended. Here is my write-up about the challenge.This is a fixed challenge of disconnection.In this challenge, we are given source co...

Patchstack Alliance CTF S01E01

noreply@dimasc.tf (Dimas Maulana) — Sun, 24 Nov 2024 01:13:00 GMT

In the recent Patchstack Alliance CTF S01E01, I am thrilled to share that I earned 2nd place and successfully solved all the challenges presented. Below is my detailed write-up of each challenge:In th...

Tot Musica (Web) Unitended Solution - Cyber Jawara International

noreply@dimasc.tf (Dimas Maulana) — Mon, 28 Oct 2024 07:37:00 GMT

Someone just recently making a new website, find the full name of the author.Please solve it in locally first!BOT: http://152.42.183.87:8182/Submit the Flag With This Format: CJ{[a-z0-9\s]}http://152....

Apache

noreply@dimasc.tf (Dimas Maulana) — Sat, 19 Oct 2024 11:50:00 GMT

SCTF havefunSCTF 2024 By W&M - W&M Team (wm-team.cn)How it works. With mod_negotiation and AddHandler type-map .var (or Options +MultiViews), Apache treats certain files as type-maps: a plain-text map...

Patchstack WCUS CTF Writeup 2024

noreply@dimasc.tf (Dimas Maulana) — Sat, 21 Sep 2024 09:43:00 GMT

Last weekend, I participated in the Patchstack WCUS CTF and solved all the WordPress challenges. Here's my write-up for each challenge from the Patchstack WCUS CTF 2024.My area have some kind of dynas...

Arbitrary File Inclusion Leading to RCE in Genie.jl - IncludeMe [idekCTF 2024]

noreply@dimasc.tf (Dimas Maulana) — Mon, 19 Aug 2024 00:24:00 GMT

In idekCTF 2024, I played with the P1G SEKAI team and secured 1st place out of 1,068 teams! I solved a challenge named "Included me" and got the first blood on that challenge.another minimalist, front...

TLS

noreply@dimasc.tf (Dimas Maulana) — Sun, 23 Jun 2024 22:35:00 GMT

https://github.com/southball/ctf-writeups/tree/main/Wani-CTF-2024/web/tls_spec Basicaly forensic+web

Exploiting Race Condition To Gain Infinity Wealth - m0leCon CTF 2023 - goldinospizza2

noreply@dimasc.tf (Dimas Maulana) — Tue, 30 Apr 2024 23:21:00 GMT

In the m0leCon CTF 2023, I participated with team TCP1P and successfully solved several web challenges.In this article, I will provide a write-up about an intriguing challenge named "goldinospizza2."...

Zero-Day XSS Found in Open Source JS Library for CTF Solution - UIUCTF 2023 - peanut-xss Writeup

noreply@dimasc.tf (Dimas Maulana) — Tue, 30 Apr 2024 23:16:00 GMT

This week, I participated in UIUCTF 2023 with the TCP1P team and successfully solved multiple challenges. One of the challenges I tackled was called "peanut-xss".In this challenge, our goal was to exp...

Exploiting the Latest Render Engine in Node (EJS) - SEETF 2023 - Express JavaScript Write-up

noreply@dimasc.tf (Dimas Maulana) — Tue, 30 Apr 2024 23:10:00 GMT

During SEETF 2023, I participated as a member of the TCP1P team and successfully solved several web challenges.In this article, I will provide a write-up for a specific challenge called "Express JavaS...

Wiki World

noreply@dimasc.tf (Dimas Maulana) — Tue, 30 Apr 2024 23:01:00 GMT

Can you alpha test out our newest note-taking website? (If you find anything, please report it to us using nc cha.hackpack.club 8702)Also unrelatedly, our website admin is really fond of the wiki-wor...

X Et Et

noreply@dimasc.tf (Dimas Maulana) — Tue, 30 Apr 2024 22:46:00 GMT

solver.py index.htmlThere are several steps to achieve RCE:Those are the steps required to work on this challenge. For the rest, you can refer to the solve script above to see the execution flow.After...

Spurdo Enbinling

noreply@dimasc.tf (Dimas Maulana) — Tue, 30 Apr 2024 11:47:00 GMT

Spurdo decided to develop a web game while he was solo leveling. But due to lack of skill, spurdo developed a game that cannot be completed by anyone sane enough. And because of that he decided to inv...