Solving Assumptions of Life: Winja CTF | Nullcon Goa 2022
Command Palette
Search for a command to run...
Comments
Join the discussionNo comments yet. Be the first to comment.
More from this blog
Abusing Resource-Based Constrained Delegation (RBCD) in Active Directory
Active Directory delegation is one of those features that makes complete sense on paper and causes constant headaches in practice. It solves a real problem. It's also misconfigured in almost every env
Jul 3, 202611 min read
Intigriti March 2026 XSS Challenge: Full Writeup
DOM Clobbering + JSONP Callback Injection via DOMPurify Misconfiguration
Apr 13, 20268 min read
Exploiting Integer Underflows in Solidity
In the world of blockchain security and Capture The Flag (CTF) challenges, vulnerabilities in smart contracts often stem from subtle arithmetic issues, especially in older Solidity versions (pre-0.8.0), where unchecked operations could lead to overfl...
Nov 25, 202511 min read
Exploiting Biased Off-Chain RNG in Ethereum Smart Contracts
This post provides a rigorous, low-level analysis of a vulnerable casino smart contract system, focusing on the interaction between on-chain logic and an off-chain RNG oracle. We formalise the vulnerability as a probabilistic bias in the oracle's out...
Nov 25, 20259 min read
GoPhish Powers RSVP for Pentester Nepal’s 12th Anniversary
Pentester Nepal, a leading cybersecurity community in Nepal, recently celebrated its 12th anniversary on August 16, 2025, at Ullens College in Lalitpur. The free event featured expert talks on bug bounty hunting, AI governance, OAuth attacks, and mor...
Aug 20, 20254 min read
Since the role had S3 in its name, we tried to list the available S3 buckets.
Now, the objects within the buckets are listed and after flag.txt is identified, the file is downloaded and submitted.