In-depth CTF writeups, vulnerability research, and exploit development. Every challenge broken down step by step — from recon to root.
Custom MT19937-variant (N=128, M=30) outputs mod 32. Recover 4096 state bits via GF(2) Gaussian elimination over 768 observed spins, predict all future rolls, win 10 trillion coins.
Race condition on email verification → CSS injection leaks admin CSRF token → DOM clobbering hijacks service worker → admin cookie exfiltrated → PDF path traversal writes uwsgi.ini → RCE.
Sort comparator function used as a code-pointer oracle to leak PIE, then swapped for printf to leak libc + canary, then scanf overwrites stack with ROP chain to achieve shell via stack pivot.