← All writeups

CTF Tasks

Capture The Flag challenge solutions and exploit writeups.

Continue Y/N — Cyber Maze Challenge V25
Dec 2, 2025
Multi-step exploitation chain: LFR → JWT forgery → SSRF → SQLi → RCE
ctfweblfijwtssrfsqlirce
SheSecured CTF — Access Denied
Jul 6, 2025
SSRF bypass using redirect rebinding to access internal endpoints
ctfwebssrfredirect
SheSecured CTF — Fama Mino?
Jul 6, 2025
SQL injection, LFI, and PHP filter chain to gain RCE
ctfwebsqlilfiphp-filter
SheSecured CTF — Injection
Jul 6, 2025
Simple command injection in a ping utility
ctfwebcommand-injection
Ramadan's Spark CTF 2025 — Secure BankSys
Mar 29, 2025
SQL injection on a banking application
ctfwebsqli
Ramadan's Spark CTF 2025 — Shadow Graph
Mar 29, 2025
GraphQL introspection to leak secrets
ctfwebgraphqlintrospection
Ramadan's Spark CTF 2025 — Shadow Graph 2
Mar 29, 2025
SSRF to GraphQL SQL injection
ctfwebssrfgraphqlsqli
Ramadan's Spark CTF 2025 — Struts
Mar 29, 2025
Apache Struts CVE-2017-5638 RCE via Content-Type header
ctfwebstrutsrce
Ramadan's Spark CTF 2025 — WhatIsXSS
Mar 29, 2025
Stored XSS with JS deobfuscation
ctfwebxss