GODSON'S BLOG
10 Writeups Logged · Web Security & CTFs

Godson's
BlogSource-Code Reviews & Web Security, One CTF At A Time

Hey there 👋 — I'm Godson, a dude who loves doing source-code reviews and web security. I'm passionate about ensuring web applications are secure, uncovering vulnerabilities, and keeping them safe.

Read The Writeups → Follow On Hashnode
Godson's profile photo

Godson

Source-Code Reviewer · Web Security · CTF Player

Hey there 👋 — I'm Godson. I spend my time digging through source code and web apps looking for the small mistakes that turn into real vulnerabilities — an XSS filter that almost works, a sanitizer with one gap, an auth check that trusts the wrong header. Most of what ends up on this blog comes out of CTFs (Intigriti's monthly XSS challenges especially) and the occasional bug bounty target.

TwitterGitHubLinkedInHashnode

Latest Writeups

CTF & Bug Bounty Writeups
Application Security

Order By Blind SQL Injection

A NahamCon CTF 2022 Flask challenge passes unsanitized user input straight into SQLAlchemy's order_by(text(...)) call, letting a CASE-based blind SQL injection exfiltrate the flag character by character.

#ctf#sql-injection#flask#python
May 1, 2022 · 4 min read
Client-Side / XSS

Abusing URL Parser for XSS

A TamilCTF challenge reflects a parsed URL's hostname unescaped into an error message. A Node.js hostname-validation CVE lets HTML tags survive as a hostname, and a form-feed injection payload turns that into working XSS against the admin bot.

#ctf#xss#nodejs#cve
Mar 28, 2022 · 4 min read
Client-Side / DOM

DOM Clobbering - Clobber Undefined Variables!

A TamilCTF web challenge with HTML injection but a tight CSP — instead of chasing script execution, we DOM-clobber two undefined debug variables (DEBUG_MODE, DEBUG_LOGGING_URL) referenced by app.js to redirect the admin bot's cookie exfiltration to our own domain.

#ctf#dom-clobbering#csp-bypass
Mar 28, 2022 · 7 min read
Client-Side / DOM

An Art of DOM Clobbering 🎭

A deep dive into DOM Clobbering from first principles — how id/name attributes create references on window and document, why window properties can't be overridden but document properties can, and how to chain clobbering across multiple levels using nested iframes.

#dom-clobbering#javascript#fundamentals
Jul 21, 2021 · 13 min read

About This Blog

Hey there 👋, I'm Godson, a dude who loves doing source-code reviews and web security. I'm passionate about ensuring web applications are secure, uncovering vulnerabilities, and keeping applications safe. Most of what lands here comes out of CTFs and community XSS challenges — browse by tag below to find a specific technique.

Find Me Elsewhere

Twitter, GitHub, LinkedIn, and the original posts on Hashnode.

TwitterGitHubLinkedInHashnode →