---
id: 4788
title: "Dojo challenge #38 - Xmas wishlist, winners and writeup"
source_domain: yeswehack.com
source_url: "https://www.yeswehack.com/dojo/dojo-ctf-challenge-winners-38"
published_at: "2025-01-23 14:56"
tags: ["bug-bounty", "ctf", "dojo", "injection", "writeup", "format-string"]
phying_url: "https://phying.com/item/4788"
lang: en
---

# Dojo challenge #38 - Xmas wishlist, winners and writeup

## Summary

Winners and writeups for Dojo challenge #38 'Xmas wishlist': a format string injection to read system environment variables and reveal the flag. Winners: YoyoDavelion, kharaone and 3c4d.

## Intelligence Metadata

- **Sources:** yeswehack.com
- **Published:** 2025-01-23 14:56
- **Original:** https://www.yeswehack.com/dojo/dojo-ctf-challenge-winners-38
- **Phying News:** https://phying.com/item/4788