Web exploitation writeups from Google CTF, HTB Cyber Apocalypse, DEF CON, NahamCon, picoCTF, and more. Organized by year and event.
2025 Challenges
Google CTF 2025
QUOTA
Category: Web · Points: 492 · Solves: 14
Race condition in API quota enforcement allows exceeding rate limits and triggering a privileged code path that leaks the flag from a server-side object store.
NOTENINJA
Category: Web · Points: 238 · Solves: 67
Stored XSS in a note-sharing app with CSP bypass via JSONP endpoint. Admin bot visits shared notes — steal admin cookie via a JSONP callback to an actor-controlled server.
HTB Cyber Apocalypse 2025
Lucky Faucet
Category: Web · Points: 325 · Solves: 312
Flask app with a predictable random seed based on server timestamp. Predict the "lucky number" to bypass authentication and claim the flag.
HateCTF
Category: Web · Points: 482 · Solves: 22
PHP PHAR deserialization attack via a file manager. Upload a PHAR disguised as an image, trigger deserialization via a custom POP chain to achieve RCE.
2024 Challenges
Google CTF 2024
SAPPY
Category: Web · Points: 267 · Solves: 54
Prototype pollution in a Node.js JSON merge function allows injecting arbitrary properties into Object.prototype, which then gets picked up by a template engine executing as admin.
GPUSHOP
Category: Web · Points: 253 · Solves: 62
GraphQL introspection reveals hidden admin mutations. Integer overflow in the price field allows purchasing a $999 GPU for $-1 (negative price billing).
picoCTF 2024
WebDecode
Category: Web · Points: 100 · Solves: 8,421
Flag hidden as a Base64-encoded data- attribute in the HTML source. Inspect → decode → flag.
SQL Direct
Category: Web · Points: 200 · Solves: 5,100
PostgreSQL login form with no input sanitization. Classic UNION-based SQL injection to dump the flags table.
2023 Challenges
NahamCon CTF 2023
Stickers
Category: Web · Points: 497 · Solves: 88
SSTI in a Python/Flask sticker generator. User input rendered directly via Jinja2 template without sanitization → OS command execution via __import__.