PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Dojo challenge #40 - Hacker profile winners & writeup

yeswehack.com | blog | #bug-bounty | #ctf | #prototype-pollution | #dojo | #javascript | #writeup
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Winners and writeups for Dojo challenge #40 'Hacker profile': exploiting JavaScript prototype pollution to trigger a catch exception handler and run arbitrary code to capture the flag.
Published
Collected

Related coverage

blog · yeswehack.com
Dojo challenge #54 Highscore solution
Dojo Solution - Hacker Club: Filter bypass and JSON injection to achieve improper access
blog · yeswehack.com
DOJO CHALLENGE #13 Winners!
Recap of DOJO Challenge #13: participants bypassed a blacklist and exploited prototype pollution to execute alert(). Winners Dominikoso, Panya and Yongi share their write-ups.
blog · yeswehack.com
DOJO CHALLENGE #9 Winners!
Recap of DOJO Challenge #9: crafting a valid prototype pollution payload to exploit SSRF and retrieve a secret flag. Robin was fastest; four top write-ups are highlighted.
blog · yeswehack.com
DOJO CHALLENGE #4 Winners!
Recap of YesWeHack's fourth DOJO Challenge, which asked hunters to defeat an obfuscated XPath request and derive working serials; includes the podium, community write-ups, and a manual-solve bonus.
blog · jfrog.com
Where Severity Scores Go Wrong: “Just Add Prototype Pollution”
JFrog researchers show how CVSS overstates risk using JavaScript prototype pollution as a case study — Axios gadget chains included — after reassessing 96% of NVD criticals as lower severity.
vulnerability · yeswehack.com
DOJO CHALLENGE #7 Winners!
DOJO Challenge #7 asked hunters to craft a valid WAF bypass to exploit XSS via prototype pollution; the post lists winners and the best write-ups covering exploitation, PoC and remediation.
Back