Ctf web

CTF Web Exploitation

Quick reference for web CTF challenges. Each technique has a one-liner here; see supporting files for full details with payloads and code.

Additional Resources

• server-side.md — SQLi, SSTI, SSRF, XXE, cmdinj, file-upload, PHP tricks, Thymeleaf/ERB/Jinja
• server-side-2.md — 2024-26: Jinja2 dict quote bypass, Thymeleaf SpEL + FileCopyUtils WAF
• server-side-deser.md — Java ysoserial, Python pickle, race conditions (TOCTOU, double-spend)
• server-side-advanced.md — ExifTool CVE, zip symlink, path bypass, Flask debug, Castor XML, React Flight
• server-side-advanced-2.md — 2025-2026: JWT-strict=false, Go err TOCTOU, Vite RCE, NFS, HQL→jshell, Firebird, polyglot
• client-side.md — XSS, CSRF, CSPT, cache-poisoning, DOM, xs-leaks, PBKDF2 timing
• client-side-2.md — 2025-26: Math.random-salt same-origin iframe collision (content-sandbox escape)
• auth-and-access.md — NoSQL bypass, parser diffs, IDOR, LLM jailbreak, subdomain takeover
• auth-and-access-2.md — 2025-2026: PHP parse_url, Next.js Next-Action SSRF, token-Map race, DNR→CDP chain
• auth-jwt.md — JWT alg none, RS256→HS256, JWK/JKU, KID traversal, JWE forgery
• auth-infra.md — OAuth/OIDC, CORS, CI/CD theft, SAML, TeamCity RCE, git history leaks
• node-and-prototype.md — prototype pollution, VM escape, Happy-DOM, flatnest
• web3.md — Solidity, proxies, ABI tricks, Foundry, transient-storage collision
• cves.md — Next.js middleware, urllib scheme, ExifTool DjVu, Ruby-SAML XPath, PaperCut

---

Pattern Recognition Index

Dispatch on observed signals, not challenge titles.

Signal in the target	Technique → file
package.json has two URL parsers (e.g. url-parse + parse-url, Node built-in + custom) and an allow-list check	Two-parser URL differential → auth-and-access.md
Node gateway in front of backend + app.all("/strict/path", ...) + nginx/Varnish proxy	%2F middleware bypass OR hop-by-hop header strip → auth-and-access.md
Flask/Django behind a reverse proxy reading X-Real-IP/X-Forwarded-For without proxy-identity check	Hop-by-hop header smuggling → auth-and-access.md
Node mysql/mysql2 + .query(q, req.body) without explicit String() coercion	Operator-object injection + __proto__ pollution → auth-and-access.md
Custom HTML sanitizer using createNodeIterator/TreeWalker then innerHTML	Declarative Shadow DOM bypass (<template shadowrootmode>) → auth-and-access.md
Vyper < 0.3.x with @nonreentrant("lock") on multiple funcs sharing storage, external call hook on path	Cross-function lock scope bug → auth-and-access.md
L1/L2 bridge storing (token, amount) on deposit but minting a canonical asset on withdraw	Ledger state-desync → auth-and-access-2.md, web3.md
Object in req.body treated as password or filter criterion ({"$gt":""}, {"$ne":null})	NoSQL auth bypass → auth-and-access.md
Template rendering user input in Jinja2 / Twig / Freemarker / ERB	SSTI → server-side.md
jwt.decode without verify=True, or RS256 keys reachable at /pubkey.pem	RS256 → HS256 confusion → auth-jwt.md
URL contains redirect_uri= and app is OAuth/OIDC	redirect_uri bypass / open redirect → auth-infra.md
Uploads path + <?php or .phar accepted / magic-bytes-only check	File upload RCE → server-side.md
File fetch with user URL, internal services in scope	SSRF (11 IP bypass techniques) → server-side.md
2 HTTP frontends (Cloudflare+nginx, HAProxy+Apache) with mismatched parsing	HTTP request smuggling → server-side.md, auth-infra.md
libxml2 XML parsing with user entities / external DOCTYPE	XXE → server-side.md
Prototype pollution sink (_.merge, Object.assign, req.body.__proto__)	Prototype pollution chain → node-and-prototype.md
parse_url($u)['host'] deny-list + subsequent readfile($u) (PHP)	Double-colon host divergence → auth-and-access-2.md
Next.js 14+ with "use server" + trustHostHeader: true in config	Next-Action forgery + host SSRF chain → auth-and-access-2.md
Shared tokens Map/object assigned in login, read in middleware pre-auth	Race on shared token map → auth-and-access-2.md
Extension manifest.json with declarativeNetRequest + innerHTML DOM sink	DNR→CDP→Puppeteer chain → auth-and-access-2.md
Traefik ≤ 2.11.13 reverse-proxy in front of app routes	X-Forwarded-Prefix admin reach + polyglot → auth-and-access-2.md, ctf-pwn/advanced-exploits-3.md
PHP JWT lib calling base64_decode($sig, false) (strict=false)	Smuggle CR/LF via JWT sig + NFKD fold → server-side-advanced-2.md
Package-level var err error + handler assigns err = …	Go shared err TOCTOU race → server-side-advanced-2.md
Vite dev server exposed + internal object.merge	Proto-pollution → spawn_sync RCE → server-side-advanced-2.md
/etc/exports without subtree_check directive	NFS handle forgery → server-side-advanced-2.md
String(path).replace('/static/','uploads/') (string not regex)	Single-match traversal → server-side-advanced-2.md
Hibernate HQL concat + H2 on classpath + jshell module	HQL → CREATE ALIAS → JDWP RCE → server-side-advanced-2.md, server-side-deser.md
wp_ajax_nopriv_* handler calling update_option($_POST['k'], …)	WP option-update privesc → server-side-advanced-2.md
Node ORM query with req.body.id uncoerced + zip upload + unhandled promise	{$gt:0} + zipslip + worker poison → server-side-advanced-2.md
Firebird banner on TCP 3050 + IIS on same host	ALTER DATABASE DIFFERENCE FILE webshell → server-side-advanced-2.md
Upload accepts TAR + exec endpoint referencing uploaded filename	TAR/ELF polyglot traversal → server-side-advanced-2.md
API returns presigned S3 URL + bucket allows ListBucket	Path traversal in presign parameter → server-side-advanced-2.md
Chromium ≥ 123 target + CSP allows inline style + admin bot iframe	CSS @starting-style/slow-selector crash oracle → client-side.md
Admin bot + cross-origin iframe + Chromium	xs-leak via performance.memory delta → client-side.md
Content-sandbox iframe where per-item origin derives from Math.random().toString(36) + parent posts {body, salt}	Salt-prediction chain → same-origin XSS → client-side-2.md
Solidity private state vars + live RPC URL	eth_getStorageAt slot enumeration → web3.md
Contract validates extcodesize once then CALLs stored addr + CREATE2 deploy allowed	SELFDESTRUCT+CREATE2 code-swap → web3.md
RPC exposes txpool_content / eth_pendingTransactions	Mempool snoop / front-run → web3.md
nonReentrant on one function, sibling shares storage without guard	Cross-function reentrancy → web3.md
foundry.toml + test/ with invariant_*() / statefulFuzz_*() / StdInvariant import	Foundry invariant fuzzing → web3.md#foundry-invariant
Solidity contract with bounded loops + assertable invariant + Halmos installable	Halmos symbolic check → web3.md#halmos
Two contracts with identical external interface (FooV1.sol / FooV2.sol, Safe.sol / Optimized.sol)	Differential fuzzing → web3.md#differential-fuzzing

Recognize the mechanic first. Never dispatch on the challenge's name.

---

For inline code/cheatsheet quick references (grep patterns, one-liners, common payloads), see quickref.md. The Pattern Recognition Index above is the dispatch table — always consult it first; load quickref.md only if you need a concrete snippet after dispatch.