Insights
Insights & Writeups
Practical security articles, vulnerability analysis, and walkthroughs focused on understanding behavior, impact, and remediation.
-
Clean Sweep — ECOVACS CGI Command Injection Timing Oracle | NNS CTF
Detailed NNS CTF IoT walkthrough covering firmware extraction, SetFct command injection, timing-oracle design, verification, and defensive lessons.
-
Light-Weight Encryption — Lattice Attack | NNS CTF
Detailed NNS CTF cryptography walkthrough explaining the weak LWE construction, modular lattice, error recovery, CVP step, and equation-level verification.
-
Min beste venn — PCAP Bit Encoding | NNS CTF
Detailed NNS CTF forensics walkthrough explaining how HTTP request multiplicity encoded bytes and how to decode the PCAP reproducibly.
-
Sleepy CPU — Power-Trace Flag Recovery | NNS CTF
Detailed NNS CTF hardware-forensics walkthrough explaining the Zephyr loop, power-trace segmentation, sampling conversion, decoder, and side-channel lessons.
-
Harald Blåtann — BLE Device Information Service | NNS CTF
Detailed NNS CTF reverse-engineering walkthrough covering Intel HEX validation, Zephyr GATT attribute reconstruction, UUID checks, and flag assembly.
-
perchance — Browser Extension Origin and Context Confusion | NNS CTF
Detailed NNS CTF browser-extension walkthrough covering URL validation, postMessage origin confusion, sanitizer replacement, trusted-origin execution, and defenses.
-
SocialPy CTF Walkthrough — Forging an Authentication Token with NaN
How a NaN literal in JSON collapsed a 1024-bit signing secret into a known constant, letting us forge an API token and read alice’s private draft post (CyberTalents Web CTF).
-
Censored Country Walkthrough — Smuggling Past a JA4 TLS Fingerprint Firewall
How a leaked X-Expected-JA4 header plus a hand-crafted uTLS ClientHello slipped past a zero-trust TLS fingerprint gateway (CyberTalents Web/Crypto CTF).
-
LEET_AS_A_SERVICE Walkthrough — Arbitrary File Read via CLI-Argument Injection
A PHP page that pastes raw input into a shell command, plus a Python script that reads file paths from argv[1], equals /flag.txt (CyberTalents Web CTF).
-
Just Health Walkthrough — Exfiltrating /flag Through a 31-Hop Redirect Chain
Turning a blind SSRF into a readable flag by abusing TooManyRedirects: a 31-hop chain of clck.ru + httpbin + tinyurl redirects ending at 127.0.0.1 (CyberTalents Web CTF).
