Web - NextBlog

Sun, 10 May 2026 00:00:00 +0000

NextBlog - CTF Writeup Link to heading

Challenge Info Link to heading

Name: NextBlog
URL: https://cyctf-luxor-cbaff7649acb-nextblog-0-0.chals.io
Category: Web
Flag: CyCTF{F7oXj5sHY4xfvfrIo2x2pkbr4eIVEW3DoYSQe1WHsx_iffn39-InchEsJKhkGtnfg8VA60x6WfCvKRQjmHzftiAxx1TvnXF8FA}

Overview Link to heading

A Next.js 16 blog application with a hidden flag server running on localhost:3001. The goal is to exploit a Server-Side Request Forgery (SSRF) vulnerability in a server action to reach the internal flag server.

WEB - Resizer

Sun, 10 May 2026 00:00:00 +0000

Resizer Writeup Link to heading

Challenge Link to heading

Name: Resizer
Category: Web
Target: http://154.57.164.66:30462

TL;DR Link to heading

The core bug is an arbitrary file write through path traversal in the upload filename:

filename = file.filename
filepath = os.path.join(app.config['UPLOAD_FOLDER'], filename)
file.save(filepath)

Because filename is never sanitized with secure_filename() and os.path.join() does not stop ../, we can write files outside uploads/.

Web on z3r0s