Web

1 min read

Writeups for the Web Exploitation challenges from CubeCTF 2025.

Challenges

  • Legal Snacks - Negative quantity parameter tampering bypasses balance checks in the snack shop to purchase the Elite Hacker Snack.
  • Todo - Prototype pollution and attribute traversal in Django-Unicorn (<0.60.0) modifies runtime settings to exfiltrate the flag via an external webhook.

Back to CubeCTF 2025

2 items under this folder.

Terminal

sigsegv@ctf:~/challenges
$ls
[1]incantation/
[2]discord/
[3]operator/
[4]is-this-stego/
[5]gnisrever/
[6]legal-snacks/
[7]todo/
[8]check-it-out/
[9]note-editor/
[10]mini-dsp/
[11]the-old-way/
[12]free-flagging/
[13]intro-to-web-part-1/
[14]intro-to-web-part-2/
[15]intro-to-web-part-3/
[16]intro-to-web-part-4/
[17]real-christmas/
[18]death-by-latex/
[19]help-desk/
[20]hidden-secrets/
[21]patient-zero/
[22]robot-rock/
[23]welcome-home/
[24]whats-up-doc/
[25]i-see-you/
[26]ill-be-reading-that/
[27]operational-oversharing/
[28]the-auditor/
[29]this-seems-odd/
$
Enter # or cmd · 'help' for info