Writeup of two Web challenges from FCSC 2025, featuring a NextJS application and a Spring Boot application.
Exploiting a Race Condition, OAuth without state and redirection into XSS & RCE via HTML2PDF to solve the last web challenge PhantomFeed from HTB University 2023
Exploiting XSS, XS-Leaks or Race condition to steal bot's GPS coordinates.
Forging custom a HTTP request to bypass a restrictive Nginx configuration. Writeup of the challenge Follow The Rabbit of FCSC2023.
Abusing the FindFirstFile Windows API function to do PHP Session Hijacking via Path Traversal. Writeup of the Demo App challenge of the THCon23 CTF.
