CTF Writeups

Click a machine name to view its writeup details and PDF.

• Popcorn New

  Difficulty: 3/5

  Gained remote access by exploiting a file upload vulnerability in a torrent web app, bypassing content-type checks to deploy a PHP webshell. Showcased how weak file upload implementations can lead to internal compromise. Also improved understanding of torrent-based platforms, which I was previously unfamiliar with.
• Attacking Enterprise Networks

  Difficulty: 4/5

  My longest penetration test, targeting an Active Directory network. It required multiple techniques, including reconnaissance and privilege escalation. I learned the importance of planning and adapting to complex environments.
• Vault

  Difficulty: 4/5

  This CTF began with brute-forcing file extensions for a file upload attack, followed by network pivoting. It took significant time, teaching me persistence and the need to test multiple approaches.
• Sneaky

  Difficulty: 4/5

  This challenge introduced IPv6 attacks and buffer overflows. The buffer overflow was difficult but rewarding, showing me the need for careful coding.
• Craft

  Difficulty: 4/5

  A long pentest focused on API exploitation. I researched API vulnerabilities, learning how to identify and attack modern web features.
• Epsilon

  Difficulty: 4/5

  A complex CTF involving AWS, JWT forging, and SSTI injection. It showed me the value of learning diverse skills to handle varied challenges.
• Strutted

  Difficulty: 4/5

  This machine required research into Apache Struts vulnerabilities. Using a .jsp webshell was new and challenging, teaching me to adapt to unfamiliar tools.
• Hawk

  Difficulty: 4/5

  This challenge involved brute-forcing OpenSSL and exploiting PHP filters for a reverse shell. It taught me to think creatively when standard methods don’t work.
• Devzat

  Difficulty: 4/5

  This machine exposed risks of public web application source code. Finding a command injection was rewarding, showing the importance of checking configurations.
• Union

  Difficulty: 3/5

  A SQL injection challenge that blocked tools like SQLMap, requiring manual exploitation. It improved my skills in manual database testing.
• Documenting & Reporting

  Difficulty: 3/5

  This pentest relied on Active Directory knowledge with limited client input. It highlighted the need for clear documentation in professional engagements.
• Soccer

  Difficulty: 3/5

  A time-consuming challenge involving WebSocket exploitation. It introduced me to new web technologies and their vulnerabilities.
• GoodGames

  Difficulty: 3/5

  This machine combined SQL injection with SSTI injection. It taught me how to chain vulnerabilities for greater impact.
• Haircut

  Difficulty: 3/5

  A command injection in the `curl` command showed flaws in common tools. It reinforced the need to check every system component.
• Bounty Hunter

  Difficulty: 3/5

  An XXE vulnerability required Python exploitation. It showed me the complexity of XML attacks and the need for custom approaches.
• Paper

  Difficulty: 3/5

  WordPress exploitation led to using the `/proc/self/` directory. It taught me the role of Linux internals in privilege escalation.
• Inject

  Difficulty: 3/5

  An LFI led to a Java-based command injection. It required learning Java vulnerabilities, improving my technical range.
• Validation

  Difficulty: 2/5

  A SQL injection used the `INTO OUTFILE` command for a web shell. It strengthened my understanding of database exploitation.
• Curling

  Difficulty: 2/5

  This challenge involved exploiting Joomla vulnerabilities. It improved my skills in attacking content management systems.
• Cap

  Difficulty: 1/5

  This machine focused on IDOR and setUID binary misconfigurations. It reminded me to always check permissions and access controls.