Source-code reviews and web security writeups — CTFs, bug bounty XSS challenges, and the occasional path traversal.https://godsons-blog.pages.dev/en-ushttps://godsons-blog.pages.dev/blog/march-2023-intigritis-xss-challenge-author-writeup/https://godsons-blog.pages.dev/blog/march-2023-intigritis-xss-challenge-author-writeup/Due to time constraints I never delivered a full write-up for my own March 2023 Intigriti challenge, so here are links to the community write-ups plus a short summary of the intended path-traversal and cache-based CSP bypass.Sun, 27 Jul 2025 00:00:00 GMTctfxssintigriticsp-bypasshttps://godsons-blog.pages.dev/blog/intigritis-nov-xss-challenge-writeup/https://godsons-blog.pages.dev/blog/intigritis-nov-xss-challenge-writeup/This is an XSS challenge on a note-taking application. The goal is to take over the admin's account, which has the flag in it — by abusing Varnish caching to smuggle an XSS past a strict CSP.Sat, 12 Nov 2022 00:00:00 GMTctfxssintigritivarnishhttps://godsons-blog.pages.dev/blog/author-writeup-intigritis-october-xss-challenge/https://godsons-blog.pages.dev/blog/author-writeup-intigritis-october-xss-challenge/This month, I created a hard XSS challenge for Intigriti that ended up with only one official solve — a chain through IP-spoofing, cookie tossing, prototype pollution, and dangling markup to leak a CSP nonce.Mon, 24 Oct 2022 00:00:00 GMTctfxssintigritiprototype-pollutioncsp-bypasshttps://godsons-blog.pages.dev/blog/b-xss-zipslip-local-file-read/https://godsons-blog.pages.dev/blog/b-xss-zipslip-local-file-read/A Cyber Apocalypse CTF 2022 web challenge chaining a blind XSS in an admin report-review page into a ZipSlip symlink attack on a firmware-upload endpoint to read /flag.txt off the server.Mon, 23 May 2022 00:00:00 GMTctfxsszipslippythonhttps://godsons-blog.pages.dev/blog/may-2022-intigriti-xss-challenge-writeup-prototype-pollution-to-overwrite-xss-filters/https://godsons-blog.pages.dev/blog/may-2022-intigriti-xss-challenge-writeup-prototype-pollution-to-overwrite-xss-filters/A client-side prototype pollution in an old jQuery.query plugin lets us reach into the js-xss library's internal whiteList object and rewrite its own sanitization rules from the outside, turning a filtered innerHTML sink into a clean DOM XSS.Tue, 03 May 2022 00:00:00 GMTctfxssprototype-pollutionintigritihttps://godsons-blog.pages.dev/blog/order-by-blind-sql-injection/https://godsons-blog.pages.dev/blog/order-by-blind-sql-injection/A NahamCon CTF 2022 Flask challenge passes unsanitized user input straight into SQLAlchemy's order_by(text(...)) call, letting a CASE-based blind SQL injection exfiltrate the flag character by character.Sun, 01 May 2022 00:00:00 GMTctfsql-injectionflaskpythonhttps://godsons-blog.pages.dev/blog/exploiting-path-traversal-in-python-application-via-ospathjoin/https://godsons-blog.pages.dev/blog/exploiting-path-traversal-in-python-application-via-ospathjoin/I had some time to play NullCon CTF 2022 with my team and decided to check out web challenges. I found a challenge called Sourcer interesting and thought, why not write about it?Sat, 09 Apr 2022 00:00:00 GMTctfpath-traversalpythonhttps://godsons-blog.pages.dev/blog/abusing-url-parser-for-xss/https://godsons-blog.pages.dev/blog/abusing-url-parser-for-xss/A TamilCTF challenge reflects a parsed URL's hostname unescaped into an error message. A Node.js hostname-validation CVE lets HTML tags survive as a hostname, and a form-feed injection payload turns that into working XSS against the admin bot.Mon, 28 Mar 2022 00:00:00 GMTctfxssnodejscvehttps://godsons-blog.pages.dev/blog/dom-clobbering-clobber-undefined-variables/https://godsons-blog.pages.dev/blog/dom-clobbering-clobber-undefined-variables/A TamilCTF web challenge with HTML injection but a tight CSP — instead of chasing script execution, we DOM-clobber two undefined debug variables (DEBUG_MODE, DEBUG_LOGGING_URL) referenced by app.js to redirect the admin bot's cookie exfiltration to our own domain.Mon, 28 Mar 2022 00:00:00 GMTctfdom-clobberingcsp-bypasshttps://godsons-blog.pages.dev/blog/an-art-of-dom-clobbering/https://godsons-blog.pages.dev/blog/an-art-of-dom-clobbering/A deep dive into DOM Clobbering from first principles — how id/name attributes create references on window and document, why window properties can't be overridden but document properties can, and how to chain clobbering across multiple levels using nested iframes.Wed, 21 Jul 2021 00:00:00 GMTdom-clobberingjavascriptfundamentals