GODSON'S BLOG
11 Writeups Logged · Web Security & CTFs

Godson's
BlogSource-Code Reviews & Web Security, One CTF At A Time

Hey there 👋 — I'm Godson, a dude who loves doing source-code reviews and web security. I'm passionate about ensuring web applications are secure, uncovering vulnerabilities, and keeping them safe.

Read The Writeups → Follow On Hashnode
Godson's profile photo

Godson

Source-Code Reviewer · Web Security · CTF Player

Hey there 👋 — I'm Godson. I spend my time digging through source code and web apps looking for the small mistakes that turn into real vulnerabilities — an XSS filter that almost works, a sanitizer with one gap, an auth check that trusts the wrong header. Most of what ends up on this blog comes out of CTFs (Intigriti's monthly XSS challenges especially) and the occasional bug bounty target.

TwitterGitHubLinkedInHashnode

Latest Writeups

CTF & Bug Bounty Writeups
Client-Side / DOM
📌 PinnedResearch

An Art of DOM Clobbering 🎭

A deep dive into DOM Clobbering from first principles — how id/name attributes create references on window and document, why window properties can't be overridden but document properties can, and how to chain clobbering across multiple levels using nested iframes.

#dom-clobbering#javascript#fundamentals
Jul 21, 2021 · 13 min read
Client-Side / XSS
CTF Author Writeup

Intigriti's Nov XSS Challenge Writeup

This is an XSS challenge on a note-taking application. The goal is to take over the admin's account, which has the flag in it — by abusing Varnish caching to smuggle an XSS past a strict CSP.

#ctf#xss#intigriti#varnish
Nov 12, 2022 · 5 min read
Chained Exploit
CTF Writeup

B-XSS -> ZipSlip -> Local File Read

A Cyber Apocalypse CTF 2022 web challenge chaining a blind XSS in an admin report-review page into a ZipSlip symlink attack on a firmware-upload endpoint to read /flag.txt off the server.

#ctf#xss#zipslip#python
May 23, 2022 · 9 min read
Application Security
CTF Writeup

Order By Blind SQL Injection

A NahamCon CTF 2022 Flask challenge passes unsanitized user input straight into SQLAlchemy's order_by(text(...)) call, letting a CASE-based blind SQL injection exfiltrate the flag character by character.

#ctf#sql-injection#flask#python
May 1, 2022 · 4 min read
Client-Side / XSS
CTF Writeup

Abusing URL Parser for XSS

A TamilCTF challenge reflects a parsed URL's hostname unescaped into an error message. A Node.js hostname-validation CVE lets HTML tags survive as a hostname, and a form-feed injection payload turns that into working XSS against the admin bot.

#ctf#xss#nodejs#cve
Mar 28, 2022 · 4 min read
Client-Side / DOM
CTF Writeup

DOM Clobbering - Clobber Undefined Variables!

A TamilCTF web challenge with HTML injection but a tight CSP — instead of chasing script execution, we DOM-clobber two undefined debug variables (DEBUG_MODE, DEBUG_LOGGING_URL) referenced by app.js to redirect the admin bot's cookie exfiltration to our own domain.

#ctf#dom-clobbering#csp-bypass
Mar 28, 2022 · 7 min read

About This Blog

Hey there 👋, I'm Godson, a dude who loves doing source-code reviews and web security. I'm passionate about ensuring web applications are secure, uncovering vulnerabilities, and keeping applications safe. Most of what lands here comes out of CTFs and community XSS challenges — browse by tag below to find a specific technique.

Find Me Elsewhere

Twitter, GitHub, LinkedIn, and the original posts on Hashnode.

Search Writeups