all ctf
Everything I've published,
in one feed.
3 posts across writeups, research, and technical deep-dives. Filter by tag.
2026.03.29
Une nuit pour hacker 2026: Thread of Doom
CTF reverse-engineering writeup: static analysis of a Windows crackme in Ghidra recovers an XOR flag from the decompilation, skipping every anti-debug check.
18 min
2025.09.21
Amazon AppSec CTF: HalCrypto
CTF writeup: a JWT jku URL check uses lastIndexOf instead of real parsing, so an @ symbol tricks it into trusting an attacker-hosted JWKS and bypasses auth.
6 min
2025.09.21
Amazon AppSec CTF: PageOneHTML
CTF writeup: an image-fetching helper on node-libcurl accepts any protocol, turning a markdown converter into an SSRF reaching an internal API via gopher://.
5 min