Hack The Box – Percetron
Full Web Exploitation Writeup (SSRF → HAProxy Bypass → MongoDB Wire Protocol → Neo4j Cypher Injection → Command Injection → RCE)
Read the storyramveil / writeups
Writeups.
Short notes and writeups on security, CTFs, and bug hunting.
All Writeups
Hack The Box – Spybug
Stored XSS exploitation via polyglot WAV file upload, strict CSP bypass using script-src self, Puppeteer admin bot abuse, and flag exfiltration through agent-controlled fields.
Read the storyHack The Box – ExpressionalRebel
CSP evaluator SSRF via localhost blacklist bypass, then time-based regex (ReDoS) exfiltration against a secret validation endpoint to recover the flag.
Read the story
NETCOMP – gunting_batu_paper
Abusing NaN behavior in Python JSON handling to bypass score validation and instantly claim the flag.
Read the story
COMPFEST17 – Dark side of asteroid
Web Exploitation Writeup (SSRF + SQLi bypass to leak internal admin secrets)
Read the story
Hack The Box 2025 – Refreshments (StackSmash)
glibc 2.23 heap exploitation with an off-by-one overflow, unsorted-bin leaks, fastbin manipulation, stack chunk placement, and __free_hook → system.
Read the story