PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Dojo challenge #36 - Shell Escape winners and writeup

yeswehack.com | blog | #rce | #access-control | #ctf | #dojo | #command-injection | #writeup
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Winners and best writeups of Dojo challenge #36 'Shell Escape': chaining broken access control in a SQL statement with a command injection flaw to achieve remote code execution.
Published
Collected

Related coverage

blog · yeswehack.com
Dojo challenge #54 Highscore solution
Dojo Solution - Hacker Club: Filter bypass and JSON injection to achieve improper access
blog · yeswehack.com
DOJO CHALLENGE #4 Winners!
Recap of YesWeHack's fourth DOJO Challenge, which asked hunters to defeat an obfuscated XPath request and derive working serials; includes the podium, community write-ups, and a manual-solve bonus.
research · eshard.com
“Wrongsomewhere”: DG’hAck CTF 2023 write-up
A write-up of DG'hAck 2023's entry "Wrongsomewhere": ransomware, esReven, Ghidra and reversing.
research · eshard.com
Damn Deprecation": DG'hAck CTF 2023 write-up
A write-up of DG'hAck 2023's entry "Damn Deprecation": ransomware, linux forensics, python bytecode and reversing.
research · eshard.com
Guest article: solving a flare-on challenge with esReven
We use esReven to solve the final challenge in last year's Flare-on reverse-engineering CTF.
research · eshard.com
PicoCTF: Power Analysis Challenges
Write-ups for three challenges of the PicoCTF 2023. These challenges are a series on side-channel power analysis using estraces & scared packages from github.
Back