Old Session
Session hijacking via an unauthenticated /sessions endpoint that leaked all active admin tokens in plain text. picoCTF W...
Web Exploitation
24 writeups covering SSTI → RCE, second-order SQL injection, IDOR via MD5 enumeration,
unrestricted file upload, session hijacking, rate limit bypass via X-Forwarded-For,
credential stuffing over raw TCP, and client-side authentication failures.
All challenges from picoCTF picoGym.
Dev Backdoor
Authentication bypass via a ROT13-obfuscated developer backdoor left in production HTML source. picoCTF Web Exploitation...
Announcements — Server-Side Template Injection
Server-Side Template Injection (SSTI) in a Jinja2/Flask announcement input escalating to Remote Code Execution and flag ...
File Upload — Unrestricted Upload to RCE
Unrestricted PHP file upload leading to web shell deployment and privilege escalation via misconfigured sudo on a picoCT...
Cookie Monster
Flag recovered from a Base64-encoded cookie value stored client-side with no server-side validation. picoCTF Web Exploit...
Heapdump — Exposed Diagnostic Endpoint
Flag extracted from a publicly accessible /heapdump endpoint that served a full server memory snapshot with no authentic...
WebDecode — Base64 in HTML Attributes
Flag recovered from a Base64-encoded value hidden inside a custom HTML attribute in page source. picoCTF Web Exploitatio...
Bookmarklet — Hardcoded Key in Client-Side JS
Flag decrypted by executing a bookmarklet's own decryption logic in the browser console — key and ciphertext both expose...
Transparent JS — Credentials in Public JavaScript
Admin credentials recovered from a public JavaScript file performing client-side authentication — picoCTF Web Exploitati...
Inspect HTML — Flag in HTML Comment
Flag discovered in an HTML comment in page source — a fundamental information disclosure vulnerability. picoCTF Web Expl...
On Includes — Flag Split Across CSS and JS
Flag split across CSS and JS comments in externally linked files — discovered by following all asset references from pag...
Cookies — Sequential Cookie Enumeration
Flag discovered by enumerating sequential numeric cookie values 0–28 via browser console automation. picoCTF Web Exploit...
Scavenger Hunt — Flag Across 5 Server Files
Flag assembled from fragments hidden across HTML source, CSS, robots.txt, .htaccess, and .DS_Store — a web enumeration c...
GET aHead — Flag in HTTP Response Headers
Flag retrieved from a custom HTTP response header using the HEAD method — discovered by reading the challenge name as a ...
Don't Use Client-Side — Flag in JS Verification Logic
Flag reassembled by reading client-side JavaScript password verification logic — chunks checked in scrambled order but a...
Login as Joe — Credential and Auth State in Cookies
Admin access achieved by reading credentials from a plain-text cookie and flipping an admin flag from false to true clie...
Robots — Flag Hidden Behind robots.txt Disallow
Flag found on a page listed under Disallow in robots.txt — demonstrating that robots.txt reveals, not conceals, sensitiv...
byp4ss3d — .htaccess Upload to PHP Execution
File upload filter bypass via .htaccess abuse: custom extension registered as PHP, web shell deployed, RCE achieved. pic...
Crack the Gate 2 — X-Forwarded-For Rate Limit Bypass
IP rate limit bypassed by spoofing X-Forwarded-For headers on each batch of brute force attempts. picoCTF Medium Web Exp...
Credential Stuffing — Raw TCP Automation with Python Sockets
Credential stuffing attack against a raw TCP service using Python sockets — 1500 credential pairs tested against a netca...
Fool the Lockout — IP Rotation via X-Forwarded-For
Flask IP rate limit bypassed by rotating spoofed X-Forwarded-For headers every 9 requests — valid credential found at li...
Hashgate — IDOR via MD5-Hashed Sequential IDs
IDOR attack against an application using MD5(user_id) as profile URL — enumerated ~20 IDs around the guest account to fi...
ORDER ORDER — Second-Order SQL Injection
Second-order SQLi in a Node.js/PostgreSQL expense tracker — username stored safely but unsafely embedded in report gener...
Secret Box — PostgreSQL INSERT Injection with Dollar-Quoting
SQL injection in a PostgreSQL INSERT statement via string concatenation — subquery extracts admin secret using dollar-qu...