.theme-toggle, .menu-toggle { display: none !important; } @media (max-width: 767px) { .header-inner { flex-wrap: wrap; padding-block: 18px; } .site-nav { display: flex; position: static; flex-wrap: wrap; width: 100%; order: 3; padding: 0; box-shadow: none; border: 0; gap: 4px 14px; } .site-nav a { font-size: 13px; padding: 8px 0; } }

ramveil / writeups

Writeups.

Short notes and writeups on security, CTFs, and bug hunting.

May 8, 2026Broken Access Control

Critical Broken Access Control Allows Student Users to Modify Other Classrooms

Security report for PixelPath LMS API: authenticated Student users can enumerate, access, and modify classrooms outside their enrollment.

Read the story

May 5, 2026Web

CBD Qualifications West Regional S3 - Challenge Writeups

Two challenges, two chains: bypass a Python proxy via duplicate Content-Type headers to trigger an unauthenticated React Server Components prototype-pollution RCE, then exploit an unbounded std::vector swap to build arbitrary read/write primitives and ROP your way to root.

Read the story

Mar 28, 2026LLM Attack

Ramadan CTF 2026 - Challenge Writeups

Make the wrong story look right...

Read the story

Feb 16, 2026Web

C2C CTF 2026 – Writeup

Full CTF Writeup (Web: CorpMail, The Soldier of God Rick | Misc: JinJail | Forensics: Log, Tattletale | Reverse: Bunaken | Blockchain: tge, Convergence, Nexus)

Read the story

Jan 30, 2026Laravel

Bug Bounty Program - MBM Vulnerabilities Stored XSS + Laravel Debug Disclosure $370

Stored XSS and Critical Information Disclosure via Laravel Debug Mode

Read the story

Jan 20, 2026Reverse Engineering

Hack The Box – ReRop

Static 64-bit binary abusing a hidden ROP chain in the .data section, stack pivot via lea rsp, chained gadgets for flag validation, and full reverse engineering of a static ELF.

Read the story