Lost Fortune Included
A PHP stream-wrapper bypass defeats the document whitelist and reads arbitrary files from the server.
web-security
8 posts
Room 404
An exposed .git directory leaks the staging source and a flag left in the repository.
The Guestbook
Prompt injection against an AI concierge reveals hidden directives and bypasses output redaction.
Towel on the Sunbed
A race condition lets parallel reward claims bypass the 24-hour lock and open the Whale Vault.
Cupid’s Matchmaker
Stored XSS in a matchmaking survey steals the reviewer’s session cookie and exposes the flag.
CupidBot
The bot leaks its verification code, which can be replayed to authorize disclosure of all three challenge flags.
TryHeartMe
An improperly protected JWT lets a normal shopper forge an admin role and redeem the staff-only flag.
Love Letter Locker
An insecure direct object reference exposes another user’s private letter—and the flag—by changing its numeric ID.
