CTF Write-ups
Field Notes & Attack Paths
Tactics, timelines, and exploitation notes across rooms, boxes, and events.
TryHackMe
6 write-upsWeb
5 entriesLove at First Breach 2026 - Advanced Track: Task 5
Leaked Flask config via a guarded SSTI, forged a JWT for admin access, pivoted through SSRF into an internal Python sandbox, then bypassed keyword filtering to read internal files.
Hidden Deep Into My Heart
Enumerated a hidden admin path from robots.txt, extracted leaked credentials from comments, authenticated to the admin portal, and recovered the flag.
Valenfind
Exploited a path traversal/LFI in dynamic layout loading to read application source, recover an admin API token, and dump the SQLite user database via an internal export endpoint.
Dogcat
LFI to log poisoning RCE, container privesc, and host escape via writable backup script.
Ultratech
Command injection in a Node.js ping endpoint leads to shell access and Docker group escalation to root.