Tag: #writeup
17 posts
UnEarthly Shop: MongoDB Aggregation to PHP Object Injection
An HTB Cyber Apocalypse 2023 write-up chaining MongoDB $lookup, mass assignment, and autoloader abuse to reach a Monolog deserialization gadget and execute /readflag.
HTB Sherlock: MisCloud
GCP incident response notes for HTB Sherlock MisCloud, covering exposed RDP, Gitea git-hook code execution, service-account abuse, Cloud Storage access, and data exfiltration.
HTB Sherlock: Nubilum-1
AWS CloudTrail investigation of unauthorized EC2 activity, exposed S3 access, attacker infrastructure changes, and PoshC2 activity.
Filtered Reality
Full-chain CTF writeup for a WordPress and Puppeteer bot challenge involving nonce leakage, DOM clobbering, CSP nonce recovery, RCE, and SHA-256 length extension.
SU_forensics
SUCTF 2026 forensics writeup for the AD1 image challenge.
UOFCTF 2025 Web challenge
Date: January 11, 2026
Fancy
Status: Done
hqlime
Status: Done
ApexSurvive
Created: September 14, 2025 11:23 AM
Data Explorer
Date: July 4, 2023 1:00 PM (EDT)