Web

1 min read

Writeups for the Web Exploitation challenges from GPNCTF 2025.

Challenges

  • Free Flagging - PHP type juggling / magic hash equality vulnerability (0e... == 0e...).
  • Intro to Web - Part 1 - Client-side parameter tampering to Local File Inclusion (LFI) reading .env.
  • Intro to Web - Part 2 - Flask session cookie forgery using leaked secret keys to access moderator endpoints.
  • Intro to Web - Part 3 - Stored XSS inside textarea reports to exfiltrate administrator session cookies to a webhook.
  • Intro to Web - Part 4 - Admin XSS / CSRF triggering internal /settings updates to enable /development routes.
  • Real Christmas - GraphQL injection in string concatenation mutations allowing unauthorized administrative privilege escalation.

Back to GPNCTF 2025

6 items under this folder.

Terminal

sigsegv@ctf:~/challenges
$ls
[1]incantation/
[2]discord/
[3]operator/
[4]is-this-stego/
[5]gnisrever/
[6]legal-snacks/
[7]todo/
[8]check-it-out/
[9]note-editor/
[10]mini-dsp/
[11]the-old-way/
[12]free-flagging/
[13]intro-to-web-part-1/
[14]intro-to-web-part-2/
[15]intro-to-web-part-3/
[16]intro-to-web-part-4/
[17]real-christmas/
[18]death-by-latex/
[19]help-desk/
[20]hidden-secrets/
[21]patient-zero/
[22]robot-rock/
[23]welcome-home/
[24]whats-up-doc/
[25]i-see-you/
[26]ill-be-reading-that/
[27]operational-oversharing/
[28]the-auditor/
[29]this-seems-odd/
$
Enter # or cmd · 'help' for info