Web exploitation writeups from Google CTF, HTB Cyber Apocalypse, DEF CON, NahamCon, picoCTF, and more. Organized by year and event.


2025 Challenges

Google CTF 2025

Google CTF 2025

QUOTA

Hard

Category: Web · Points: 492 · Solves: 14

Race condition in API quota enforcement allows exceeding rate limits and triggering a privileged code path that leaks the flag from a server-side object store.

Race ConditionAPI AbuseTiming Attack
Google CTF 2025

NOTENINJA

Medium

Category: Web · Points: 238 · Solves: 67

Stored XSS in a note-sharing app with CSP bypass via JSONP endpoint. Admin bot visits shared notes — steal admin cookie via a JSONP callback to an actor-controlled server.

Stored XSSCSP BypassJSONPCookie Theft

HTB Cyber Apocalypse 2025

HTB Cyber Apocalypse 2025

Lucky Faucet

Easy

Category: Web · Points: 325 · Solves: 312

Flask app with a predictable random seed based on server timestamp. Predict the "lucky number" to bypass authentication and claim the flag.

Weak RandomnessPython FlaskTimestamp Seed
HTB Cyber Apocalypse 2025

HateCTF

Hard

Category: Web · Points: 482 · Solves: 22

PHP PHAR deserialization attack via a file manager. Upload a PHAR disguised as an image, trigger deserialization via a custom POP chain to achieve RCE.

PHP DeserializationPHARPOP ChainRCE

2024 Challenges

Google CTF 2024

Google CTF 2024

SAPPY

Medium

Category: Web · Points: 267 · Solves: 54

Prototype pollution in a Node.js JSON merge function allows injecting arbitrary properties into Object.prototype, which then gets picked up by a template engine executing as admin.

Prototype PollutionNode.jsTemplate Engine RCE
Google CTF 2024

GPUSHOP

Medium

Category: Web · Points: 253 · Solves: 62

GraphQL introspection reveals hidden admin mutations. Integer overflow in the price field allows purchasing a $999 GPU for $-1 (negative price billing).

GraphQLInteger OverflowBusiness Logic

picoCTF 2024

picoCTF 2024

WebDecode

Easy

Category: Web · Points: 100 · Solves: 8,421

Flag hidden as a Base64-encoded data- attribute in the HTML source. Inspect → decode → flag.

Source ReviewBase64
picoCTF 2024

SQL Direct

Easy

Category: Web · Points: 200 · Solves: 5,100

PostgreSQL login form with no input sanitization. Classic UNION-based SQL injection to dump the flags table.

SQLiUNIONPostgreSQL

2023 Challenges

NahamCon CTF 2023

NahamCon 2023

Stickers

Medium

Category: Web · Points: 497 · Solves: 88

SSTI in a Python/Flask sticker generator. User input rendered directly via Jinja2 template without sanitization → OS command execution via __import__.

SSTIJinja2FlaskRCE