CTF Web Challenge Writeups and Techniques
Information Gathering
web1
Viewing page source code reveals the flag. Right-click context menu or Ctrl+U keyboard shortcut provides access.
web2
Direct browser DevTools access may be restricted. Alternative approaches include:
Prefixing URL with view-source:
Using Ctrl+U keyboard shortcut
Opening DevTools via Ctrl+Shift+I
Intercepting network ...
Posted on Tue, 25 Aug 2026 16:50:26 +0000 by Roble
Code Injection and OS Command Injection in Web Security
PHP Code Injection
Root Cause
Inadequate input validation combined with the use of dangerous PHP functions like eval() and assert() allows attackers to inject arbitrary code. A successful exploit can lead to full control over the web application and potentially the underlying server, effectively creating a backdoor.
Dangerous Functions
eval()
e ...
Posted on Wed, 22 Jul 2026 16:12:55 +0000 by ex247
Mitigating Command Injection Vulnerabilities in Java's Runtime.exec() Method
The Runtime.getRuntime().exec() method in Java allows execution of system commends or scripts. However, if command arguments are derived from external, untrusted input, this can introduce a command injection vulnerability. An attacker could manipulate the input to execute arbitrary, potentially harmful commands on the host system.
To mitigate t ...
Posted on Mon, 01 Jun 2026 17:52:25 +0000 by Sphen001