// 01 — field notes
CTF writeups, security research, and technical insights
Showing all 5 write-ups
Three chained bugs and a deliberate canary. The obvious path ends on a planted flag that gets you banned; the real one needs a client-side attempt counter and a 10,000-PIN sweep.
Two first-party identity providers, one of which forgot to pin its signing certificate. An error oracle in the callback exposed the gap, and the admin gate keyed off scope rather than sub.
The per-character delay multiplier came from your own User-Agent. Crank it up and the signal saturates — most of the work was stopping the measurement methodology from lying.
A six-stage chain behind a load balancer where only one of four workers serves the relay, the clock must be re-synced before every request, and a catch-all route manufactures false positives.
This writeup covers two challenges from the Claw the Flag CTF: pyjail and F.R.E.E.D.O.M. Both challenges involved clever exploitation techniques to bypass restrictions and retrieve…