Writeups

Stats

6

Writeups

Six Misconfigurations, One Click, Full Account Takeover

How I chained CSRF token bypass, SameSite=None cookies, HTTP method override, and text/plain Content-Type abuse into a single-click account takeover on a hardened production platform.

The Redirect Any App Could Catch leading to ATO

From a decompiled APK to minting my own OAuth tokens, and the custom scheme that let any app on the phone catch them to Account Takeover.

When a Send Button Becomes a Trusted Mail Relay

A business-logic bug that turned a fresh account with no company context into a fully functional phishing relay using the platform's own mail infrastructure.

A Host Token That Talked To Strangers

Out of the box bug hunting.

Thank You Javascript - Plfanzen 2026 CTF Writeup

Using multiple unique JS techniques to get to the flag.

Breaking SameSite=Strict in chrome

How we bypassed SameSite=Strict protections using service worker, unintentionally