CTF Writeups

url: 
title: "CTF Writeups – Medium"
description: "A collection of write-ups for various systems."
host: medium.com
favicon: https://miro.medium.com/v2/5d8de952517e8160e40ef9841c781cdc14a5db313057fa3c3de41c6f5b494b19
image: https://cdn-images-1.medium.com/max/1200/1*5zNB5VCkfVKpJgEN5laETw.png

CTFtime.org / Writeups

url: 
title: "CTFtime.org / Writeups"
description: "Capture The Flag, CTF teams, CTF ratings, CTF archive, CTF writeups"
host: ctftime.org
favicon: https://ctftime.org/favicon.png

url: https://medium.com/@Inching-Towards-Intelligence/reflections-on-grinding-through-100-ctf-writeups-a61ce4095d7a
title: "Reflections On Grinding Through 100 CTF Writeups"
description: "A Note on Intelligence vs Work Ethic"
host: medium.com
favicon: https://miro.medium.com/v2/5d8de952517e8160e40ef9841c781cdc14a5db313057fa3c3de41c6f5b494b19
image: https://miro.medium.com/v2/resize:fit:971/1*wU26yCoKvlqpxYItuZOFzg.png

#deepseek

Here’s a curated list of blogs and resources to help you master web exploitation in CTF challenges, based on the search results provided:

1. Infosec Writeups: IRON CTF 2024 Web Exploitation

Focus: Detailed walkthroughs of real CTF challenges like exploiting Local File Inclusion (LFI), PHP deserialization vulnerabilities, and Python CVEs (e.g., CVE-2023-24329).
Key Topics:
- Crafting payloads for LFI to read server files .
- Bypassing PHP weak comparisons using MD5 hash collisions .
- Exploiting Python’s urllib vulnerabilities for SSRF and command injection .
Link: IRON CTF 2024 Official Writeup

2. 先知社区 (Xianzhi Community): picoCTF2018 Web Writeups

Focus: Beginner-friendly CTF challenges, including client-side vulnerabilities, SQL injection, and cookie manipulation.
Key Topics:
- Solving SQLi with admin' OR '1'='1 payloads .
- Bypassing authentication via JWT tampering and cookie forging .
- Manual HTTP request crafting for flag extraction .
Link: picoCTF2018 Web Exploitation Writeup

3. Ank's Blog: picoCTF Web Exploitation Series

Focus: Step-by-step solutions for challenges like HTTP method manipulation, cookie brute-forcing, and hidden file discovery.
Key Topics:
- Using curl to inspect headers for flags (e.g., GET aHEAD challenge) .
- Analyzing .htaccess, .DS_Store, and robots.txt for hidden flags .
- Reverse-engineering JavaScript WebAssembly modules .
Link: Ank's picoCTF Writeup

4. MetaCTF Blog: CTF 101 Series

Focus: Foundational knowledge for web exploitation, including vulnerability identification and exploitation strategies.
Key Topics:
- Probing apps with Burp Suite for backend vulnerabilities .
- Exploiting SQL injection and SSRF flaws .
- OWASP Top 10 risks and practical mitigation techniques .
Link: What is Web Exploitation?

5. GitHub: TPW-CTF-2024 Write-Up Repository

Focus: Hands-on walkthroughs for XXE injection, binary exploitation, and cryptography.
Key Topics:
- Exploiting XML parsers for server data leaks .
- Solving challenges involving corrupted hex data and TCP captures .
Link: TPW-CTF-2024 GitHub Repo

6. Ribom's Blogs: Iris CTF 2025 Writeups

Focus: Analysis of Go-based web applications, path traversal prevention, and MySQL database exploitation.
Key Topics:
- Bypassing sanitization in custom routing modules .
- Exploiting password managers with insecure initialization .
Link: Iris CTF 2025 Writeup

Additional Tips:

Practice Platforms: TryHackMe and Hack The Box offer guided labs for web exploitation .
Stay Updated: Follow CTFtime for global competitions and VulnHub for self-paced VM challenges .

For a deeper dive, explore the linked blogs and repositories. Each resource provides actionable techniques and real-world examples to sharpen your skills! 🔍✨