web
GateCrash
Deep dive into Nim-specific CRLF injection (CVE-2020-15693). Shows how to inject JSON payloads into headers to bypass frontend filters and achieve SQL injection.
by gianlu33
7 min
Writeups
web 5 writeups
filter archive
year & competition
categories
tags
web
PhantomFeed
Multi-stage web exploitation involving a ReDoS-powered race condition, OAuth2-based XSS for token theft, and a final RCE via HTML2PDF font abuse.
by tomvg
6 min
web
poster-thief-3
Hands-on tutorial on manipulating HTTP headers using curl. Demonstrates how to bypass server-side checks for User-Agent, Referer, and custom headers.
by vikvanderlinden
3 min
web
poster-thief-2
Detailed exploration of Path Traversal vulnerabilities. Explains how to bypass non-recursive traversal filters by nesting sequences to reach sensitive system files.
by vikvanderlinden
5 min
web
poster-thief-1
Introduction to the security.txt standard (RFC 9116). Shows how to locate and use a site's security policy to find hidden contact information and flags.
by vikvanderlinden
1 min