Lumy

Wordpress forensics Ips and versions

Wordpress forensics bruteforce username, passwords and method used

Wordpress forensics tools used by attacker and CVE associated

Python Jail

Simple Binary Reverse

HTTP parameter pollution attack leading to LFI

Pickle deserialization exploitation

Blind NoSQL injection on MongoDB

mt_rand vulnerability

SSTI in Web pokemon starter pick challenge

Underflow exploit

Track a target based on a phone number

Random seed but with low value that can be bruteforced

Unity3D Gacha Game system : Solved using DNSpy, Cheatengine and Wireshark as no server side verification

Exploit example of a bufferoverflow on the OSCP exam

Exploit zip with ascci SHA 1 representation

Python jail with blacklist containg all letters + "." Unicode and octal is key

Python jail with blacklist containg all letters + "." Unicode and octal is key

Python jail with no builtins, using os._wrap_close to get the flag

Python jail with no builtins, "__" filters and size limitation. Unicode and _frozen_importlib_external.FileLoader was the solution

Exploit MacOS autologon feature

Getting secrets through stacktraces with flask

Getting secrets through stacktraces with flask

Getting secrets through stacktraces with flask

Getting secrets through stacktraces with flask

Getting secrets through stacktraces with flask

Browser data exploit

Bruteforce cracking of zip and pdf file

Google form misconfiguration permitting to see previous responses

Python jail with a huge blacklist. If we can't bypass the blacklist, let's delete the blacklist using pop

PCAP capture with RCE on the system through webshell

An encrypted zip file, with partial knowledge of a file content

Python jail with blacklist containg all letters + "." Unicode and octal is key

Python jail with blacklist containg all letters + "." + cmd restrictions. Unicode and octal is key

Char by Char password comparison. Bruteforce and reverse solutions

Exfiltration of sensible data using steganography upon network

Changing algorithm from RS256 to HS256, bypassing signature process

Cryptanalysis

Cryptanalysis

One time pad reuse