#ctf — Godson's Blog

Client-Side / XSS

March 2023 - Intigriti's XSS Challenge - Author Writeup

Due to time constraints I never delivered a full write-up for my own March 2023 Intigriti challenge, so here are links to the community write-ups plus a short summary of the intended path-traversal and cache-based CSP bypass.

#ctf #xss #intigriti #csp-bypass

Jul 27, 2025 · 2 min read

Client-Side / XSS

Intigriti's Nov XSS Challenge Writeup

This is an XSS challenge on a note-taking application. The goal is to take over the admin's account, which has the flag in it — by abusing Varnish caching to smuggle an XSS past a strict CSP.

#ctf #xss #intigriti #varnish

Nov 12, 2022 · 5 min read

Client-Side / XSS

Intigriti's October 2022 - XSS Challenge Author Writeup

This month, I created a hard XSS challenge for Intigriti that ended up with only one official solve — a chain through IP-spoofing, cookie tossing, prototype pollution, and dangling markup to leak a CSP nonce.

#ctf #xss #intigriti #prototype-pollution #csp-bypass

Oct 24, 2022 · 24 min read

Chained Exploit

B-XSS -> ZipSlip -> Local File Read

A Cyber Apocalypse CTF 2022 web challenge chaining a blind XSS in an admin report-review page into a ZipSlip symlink attack on a firmware-upload endpoint to read /flag.txt off the server.

#ctf #xss #zipslip #python

May 23, 2022 · 9 min read

Client-Side / XSS

May 2022 - Intigriti XSS Challenge Writeup - Prototype Pollution to Overwrite XSS filters!!!

A client-side prototype pollution in an old jQuery.query plugin lets us reach into the js-xss library's internal whiteList object and rewrite its own sanitization rules from the outside, turning a filtered innerHTML sink into a clean DOM XSS.

#ctf #xss #prototype-pollution #intigriti

May 3, 2022 · 22 min read

Application Security

Order By Blind SQL Injection

A NahamCon CTF 2022 Flask challenge passes unsanitized user input straight into SQLAlchemy's order_by(text(...)) call, letting a CASE-based blind SQL injection exfiltrate the flag character by character.

#ctf #sql-injection #flask #python

May 1, 2022 · 4 min read

Application Security

Exploiting Path Traversal in Python Application via os.path.join

I had some time to play NullCon CTF 2022 with my team and decided to check out web challenges. I found a challenge called Sourcer interesting and thought, why not write about it?

#ctf #path-traversal #python

Apr 9, 2022 · 3 min read

Client-Side / XSS

Abusing URL Parser for XSS

A TamilCTF challenge reflects a parsed URL's hostname unescaped into an error message. A Node.js hostname-validation CVE lets HTML tags survive as a hostname, and a form-feed injection payload turns that into working XSS against the admin bot.

#ctf #xss #nodejs #cve

Mar 28, 2022 · 4 min read

Client-Side / DOM

DOM Clobbering - Clobber Undefined Variables!

A TamilCTF web challenge with HTML injection but a tight CSP — instead of chasing script execution, we DOM-clobber two undefined debug variables (DEBUG_MODE, DEBUG_LOGGING_URL) referenced by app.js to redirect the admin bot's cookie exfiltration to our own domain.

#ctf #dom-clobbering #csp-bypass

Mar 28, 2022 · 7 min read

Tagged: #ctf