$ grep -r "flag{" ./writeups
Writeups
Each entry walks the full process—recon, hypothesis, exploitation, fix. Filter by category below.
ret2libc with no leak: beating ASLR by partial brute force
Classic overflow, NX enabled, no /bin/sh at hand. We chain ret2plt, a GOT leak and a second pass.
read →
Unpacking a custom packer by hand with Ghidra + x64dbg
In-memory decryption at runtime. Spot the routine, set the breakpoint at the right OEP, dump the reconstructed image.
read →
From a "harmless" SSRF to stolen cloud credentials
An image preview that accepts a URL. Pivot to the metadata endpoint, grab a token, and the role IMDSv2 plays.
read →
Padding oracle: decrypting without ever knowing the key
CBC + overly chatty error messages = byte-by-byte decryption. Anatomy of an oracle and how it's exploited.
read →
Memory dump: finding the malicious process with Volatility3
A 4 GB .raw, a quiet attacker. List hidden processes, extract the injected one, trace back to the C2.
read →
One handle, an entire attack surface
How a reused identifier ties together accounts, repos and metadata—and how to shrink your footprint.
read →