← All writeups

CTF Tasks

Capture The Flag challenge solutions and exploit writeups.

CTF
Dec 2, 2025
Continue Y/N — Cyber Maze Challenge V25
Multi-step exploitation chain: LFR → JWT forgery → SSRF → SQLi → RCE
ctfweblfijwtssrfsqlirce
CTF
Jul 6, 2025
SheSecured CTF — Access Denied
SSRF bypass using redirect rebinding to access internal endpoints
ctfwebssrfredirect
CTF
Jul 6, 2025
SheSecured CTF — Fama Mino?
SQL injection, LFI, and PHP filter chain to gain RCE
ctfwebsqlilfiphp-filter
CTF
Jul 6, 2025
SheSecured CTF — Injection
Simple command injection in a ping utility
ctfwebcommand-injection
CTF
Mar 29, 2025
Ramadan's Spark CTF 2025 — Secure BankSys
SQL injection on a banking application
ctfwebsqli
CTF
Mar 29, 2025
Ramadan's Spark CTF 2025 — Shadow Graph
GraphQL introspection to leak secrets
ctfwebgraphqlintrospection
CTF
Mar 29, 2025
Ramadan's Spark CTF 2025 — Shadow Graph 2
SSRF to GraphQL SQL injection
ctfwebssrfgraphqlsqli
CTF
Mar 29, 2025
Ramadan's Spark CTF 2025 — Struts
Apache Struts CVE-2017-5638 RCE via Content-Type header
ctfwebstrutsrce
CTF
Mar 29, 2025
Ramadan's Spark CTF 2025 — WhatIsXSS
Stored XSS with JS deobfuscation
ctfwebxss