PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

DOJO CHALLENGE #21 Winners!

yeswehack.com | vulnerability | #bug-bounty | #access-control | #sql-injection | #web-security | #cwe-284 | #dojo | #write-up
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Winners of DOJO Challenge #21 'EvilTwin-Admin', where players exploited a SQL logic flaw to register an admin account, a Broken Access Control case (CWE-284). Top write-ups: Floczii, W00dy, clhack.
Published
Collected

Related coverage

vulnerability · yeswehack.com
DOJO CHALLENGE #20 Winners!
Winners of DOJO Challenge #20 'Butters Adventure', which required exploiting a DOM-based XSS via the $cmd parameter. Best write-ups: Tihmz, bosstester and Braxoia.
vulnerability · yeswehack.com
DOJO Challenge #23 Winners!
Winners and best write-ups from DOJO Challenge #23 '5Ways2XSS', where players had to craft a single payload that exploited five XSS-vulnerable input sections at once.
vulnerability · yeswehack.com
DOJO Challenge #22 Winners!
Winners of DOJO Challenge #22 'Butters Adventure v2', where players used a DOM clobbering technique to overwrite JavaScript's getElementById() function. Top write-ups: Scttpr, CharlB, hamzaavvan.
vulnerability · yeswehack.com
DOJO CHALLENGE #6 Winners!
DOJO Challenge #6 recap: participants crafted SQL injection payloads that bypassed an input filter forbidding common SQL comment syntax; lists the fastest solves and best write-ups.
vulnerability · yeswehack.com
DOJO CHALLENGE #3 Winners!
DOJO Challenge #3 asked players to trigger XSS through two heavily filtered parameters inside a conditional block; the post announces first solves, best write-ups and the DOJO training platform.
vulnerability · yeswehack.com
DOJO CHALLENGE #5 Winners!
DOJO Challenge #5 was a hardcore variant of #3: trigger an XSS payload using a severely restricted character set that banned parentheses, numbers and dots; lists winners and best write-up.
Back