A Python exec chain exploitation that abuses a check->execute->execute chain, with a very restrictive 300 byte limit.
mediumWeb
// archive
Writeups
Machine and challenge walkthroughs. Active targets can stay protected behind their root flag.
A classic decode-after-check vulnerability to blacklist based WAF bypass, leading to a blind SQLi.
mediumSQL InjectionWeb
A beautiful prototype pollution puzzle on an old Node version, with multiple solutions via symbolic links, Node executable arguments or straight up shell commands.
mediumPrototype PollutionWeb