PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Dojo challenge #38 - Xmas wishlist, winners and writeup

yeswehack.com | blog | #bug-bounty | #ctf | #dojo | #injection | #writeup | #format-string
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Winners and writeups for Dojo challenge #38 'Xmas wishlist': a format string injection to read system environment variables and reveal the flag. Winners: YoyoDavelion, kharaone and 3c4d.
Published
Collected

Related coverage

blog · yeswehack.com
Dojo challenge #54 Highscore solution
Dojo Solution - Hacker Club: Filter bypass and JSON injection to achieve improper access
blog · yeswehack.com
DOJO CHALLENGE #4 Winners!
Recap of YesWeHack's fourth DOJO Challenge, which asked hunters to defeat an obfuscated XPath request and derive working serials; includes the podium, community write-ups, and a manual-solve bonus.
research · eshard.com
“Wrongsomewhere”: DG’hAck CTF 2023 write-up
A write-up of DG'hAck 2023's entry "Wrongsomewhere": ransomware, esReven, Ghidra and reversing.
research · eshard.com
Damn Deprecation": DG'hAck CTF 2023 write-up
A write-up of DG'hAck 2023's entry "Damn Deprecation": ransomware, linux forensics, python bytecode and reversing.
research · eshard.com
Guest article: solving a flare-on challenge with esReven
We use esReven to solve the final challenge in last year's Flare-on reverse-engineering CTF.
research · eshard.com
PicoCTF: Power Analysis Challenges
Write-ups for three challenges of the PicoCTF 2023. These challenges are a series on side-channel power analysis using estraces & scared packages from github.
Back