Room: Towel on the SunbedCategory: Web | Difficulty: Medium | Points: 90 Ponzi set his towel down for one 24-hour reward claim. He came back to find the sunbed had been “claimed” three times over while he wasn’t looking. This one is a race condition challenge dressed up as a crypto rewards app. The briefing […]
POP Restaurant is a PHP object injection challenge from Hack The Box. Rather than exploiting a running service blindly, this challenge provides the application source code, allowing us to review the code and identify a usable gadget chain. The vulnerability lies in the unsafe use of PHP’s unserialize() function on user-controlled data. Our goal is
This challenge is part of TryHackMe’s Love at First Breach 2026 Valentine event. Challenge: Corp WebsiteCategory: Web Difficulty: Medium I started by visiting the target web app and intercepting traffic with Burp Suite Proxy. The application appears to be a wedding-planning business site, and it is built with Next.js. That technology detail ended up being important for narrowing down
This challenge is from the Love at First Breach Valentine event on TryHackMe. Challenge Title: ValenfindCategory: WebDifficulty: Medium The target web app is running on port “5000”. Before exploring the app, I ran an initial `nmap` scan to check for other exposed services. The service fingerprint on port `5000` shows: `Server: Werkzeug/3.0.1 Python/3.12.3` That strongly suggests a Flask
This challenge is from the Love at First Breach Valentine event on TryHackMe. Challenge title: TryHeartMeCategory: Web Difficulty: Easy The objective of this challenge is to purchase the hidden Valenflag item from the web shop. I started by opening the challenge URL (port 5000) and monitoring traffic with Burp Suite to understand request and response behavior. The target application is a Valentine-themed
This challenge is part of the Love at First Breach Valentine event on TryHackMe. Challenge title: Hidden Deep Into my HeartCategory: WebDifficulty: Easy I started with a quick service scan using nmap. nmap -sV [MACHINE_IP] The main target was on the port 5000. The fingerprint (Server: Werkzeug/3.1.5 Python/3.10.12) indicates a Python web app, likely Flask. Next, I browsed the app
The Huntress CTF 2025 presented some fascinating web security challenges that tested various attack vectors and exploitation techniques. In this writeup, I’ll walk you through three compelling web challenges: ARIKA, Sigma Linter, Emotional, and Flag Checker. Each challenge showcased different vulnerability classes — from regex bypass and command injection to YAML deserialization and server-side template injection, and timing attacks. Day 04 Challenge:
A vulnerable loan calculator used eval on user-supplied expressions. Because the evaluator ran Python and performed only a textual blacklist of dangerous keywords in the submitted payload (not on strings constructed at runtime), it was possible to craft a payload that decodes and executes a harmless-looking string, which, when decoded at runtime, performs the file read of /flag.txt. Platform: picoCTFChallenge: 3v@lDifficulty: Medium Recon — understanding
Spookifier Challenge on HackTheBox Challenge Description There’s a new trend of an application that generates a spooky name for you. Users of that application later discovered that their real names were also magically changed, causing havoc in their life. Could you help bring down this application? Overview When I first looked at the challenge, I
This post is a write-up for the “Security Footage” challenge on TryHackMe. The challenge description reads: “Someone broke into our office last night, but they destroyed the hard drives with the security footage. Can you recover the footage?” We’re provided with a .pcap file (packet capture) that presumably contains the remaining trace of the lost footage. Analyzing