Exploiting Smarty template injection and bypassing a substring WAF with string concatenation.

Recovering the flag integer from residues modulo small primes and a quotient.

Building a valid token, overflowing an 80-byte stack buffer, and returning into win().

Hand-building x86-64 Linux shellcode with jmp-call-pop and null-byte avoidance.

Accepted first-blood reverse-engineering flag; local detailed analysis needs reconstruction before public publishing.

Reverse-engineering a .NET malware dropper, decrypting an embedded payload, and extracting a statically built flag.

Exploiting a Server-Side Request Forgery vulnerability to access the Docker Engine API, spawning a privileged container with host filesystem mount to read the flag.

Exploiting an unsanitized INSERT statement in a Flask/SQLite3 registration form — using ON CONFLICT DO UPDATE to overwrite the admin password and capture the flag.

Exploiting a LaTeX injection vulnerability in a web application to read local files and gain initial access to the system.

Exploiting a JWT algorithm confusion vulnerability where the server accepts 'none' algorithm, allowing token forgery and admin access.