/ Recent content on Hugo -- gohugo.io Sat, 28 Feb 2026 00:00:00 +0000 /writeups/olicyber/territoriale2026/demo/dynamicsecret/ Sat, 28 Feb 2026 00:00:00 +0000 /writeups/olicyber/territoriale2026/demo/dynamicsecret/ Use strace to trace the runtime syscalls of a binary and read the secret it loads from a file. /writeups/olicyber/territoriale2026/demo/http-inputs/ Sat, 28 Feb 2026 00:00:00 +0000 /writeups/olicyber/territoriale2026/demo/http-inputs/ Send a single HTTP OPTIONS request with the exact query param, header, cookie, and body the server expects simultaneously. /writeups/olicyber/territoriale2026/demo/math-solver/ Sat, 28 Feb 2026 00:00:00 +0000 /writeups/olicyber/territoriale2026/demo/math-solver/ Automate solving 100 consecutive linear equations within a single HTTP session to unlock the flag. /writeups/olicyber/territoriale2026/demo/revme/ Sat, 28 Feb 2026 00:00:00 +0000 /writeups/olicyber/territoriale2026/demo/revme/ Reverse a three-step transformation (reverse + rotate + XOR) applied to a 36-byte target symbol to recover the flag. /writeups/olicyber/territoriale2026/demo/secureadminpanel/ Sat, 28 Feb 2026 00:00:00 +0000 /writeups/olicyber/territoriale2026/demo/secureadminpanel/ Leak the stack canary via a controlled print function, then overflow to overwrite the return address without triggering the canary check. /writeups/olicyber/territoriale2026/demo/sqli-cards/ Sat, 28 Feb 2026 00:00:00 +0000 /writeups/olicyber/territoriale2026/demo/sqli-cards/ Union-based SQL injection in a card lookup form to enumerate tables via sqlite_master and extract the flag. /writeups/olicyber/territoriale2026/demo/xss-escape/ Sat, 28 Feb 2026 00:00:00 +0000 /writeups/olicyber/territoriale2026/demo/xss-escape/ Escape a JavaScript string context inside a script tag by injecting a closing script tag that the sanitizer fails to block. /writeups/olicyber/territoriale2025/baity5/ Sat, 01 Mar 2025 00:00:00 +0000 /writeups/olicyber/territoriale2025/baity5/ Binary exploitation challenge from Territoriale 2025. Static analysis and attack strategy — no full exploit solved during competition. /writeups/olicyber/territoriale2025/bash-filter-bypass/ Sat, 01 Mar 2025 00:00:00 +0000 /writeups/olicyber/territoriale2025/bash-filter-bypass/ Bypass a character-level bash filter by substituting ASCII letters with Unicode homoglyphs that the shell normalizes. /writeups/olicyber/territoriale2025/segnalazione-cinghiali/ Sat, 01 Mar 2025 00:00:00 +0000 /writeups/olicyber/territoriale2025/segnalazione-cinghiali/ Union-based SQL injection in the report ID parameter of a Node.js/TypeScript Express app to leak the flag from a hidden table. /writeups/cyberchallenge/web/bank-logic-bypass/ Wed, 01 Jan 2025 00:00:00 +0000 /writeups/cyberchallenge/web/bank-logic-bypass/ Submit a withdrawal amount in scientific notation to exploit loose type parsing and credit 1 billion to your balance. /writeups/cyberchallenge/misc/basic-calculator/ Wed, 01 Jan 2025 00:00:00 +0000 /writeups/cyberchallenge/misc/basic-calculator/ Identify and work around a Python variable shadowing bug where a function definition overwrites a string variable of the same name. /writeups/cyberchallenge/web/blind-sqli/ Wed, 01 Jan 2025 00:00:00 +0000 /writeups/cyberchallenge/web/blind-sqli/ Boolean blind SQL injection on a login form to extract a password character by character using HEX comparison. /writeups/cyberchallenge/web/extract-html-comments/ Wed, 01 Jan 2025 00:00:00 +0000 /writeups/cyberchallenge/web/extract-html-comments/ Use BeautifulSoup to extract HTML comment nodes from a page and reveal the hidden flag. /writeups/cyberchallenge/software-security/shellfour-orw/ Wed, 01 Jan 2025 00:00:00 +0000 /writeups/cyberchallenge/software-security/shellfour-orw/ Write open-read-write shellcode to exfiltrate /flag.txt when execve is blocked by a seccomp filter. /writeups/cyberchallenge/software-security/shellone/ Wed, 01 Jan 2025 00:00:00 +0000 /writeups/cyberchallenge/software-security/shellone/ Write minimal x86 shellcode that sets EAX to 0x13371338 to satisfy the binary’s check and unlock execution flow. /writeups/cyberchallenge/software-security/split/ Wed, 01 Jan 2025 00:00:00 +0000 /writeups/cyberchallenge/software-security/split/ Classic x86-64 ret2win: overflow the return address, use a pop rdi gadget to pass the /bin/cat flag.txt string as argument, jump to system. /writeups/cyberchallenge/misc/unzip-matryoshka/ Wed, 01 Jan 2025 00:00:00 +0000 /writeups/cyberchallenge/misc/unzip-matryoshka/ Automate extraction of 3000 nested zip files to retrieve the flag from the innermost archive. /writeups/olicyber/challenges/colicyber/misc/2048/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/misc/2048/ Connect to a server that fires 2049 arithmetic challenges in Italian — SOMMA, DIFFERENZA, PRODOTTO, POTENZA, DIVISIONE_INTERA — and solve each one in under the timeout to receive the flag. /writeups/olicyber/challenges/colicyber/web/a-too-small-reminder/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/a-too-small-reminder/ Register, log in, notice the session_id cookie is a small integer. Brute-force integers upward from 30 until the admin session is hit and the flag appears. /writeups/olicyber/challenges/colicyber/binary/asmr/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/asmr/ Reverse a static XOR encryption: subtract flag bytes from key bytes position-by-position to recover the plaintext. /writeups/olicyber/challenges/colicyber/misc/based-and-encoded/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/misc/based-and-encoded/ A JSON-framed server demands conversions between base64, hex, and binary in both encode and decode directions. Write a bot that parses the Italian operation description and returns the correct transformed value. /writeups/olicyber/challenges/colicyber/web/basic-sqli/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/basic-sqli/ Inject ‘ OR ‘1’=‘1 into both username and password fields to make the SQL query always true and grab the flag from the response. /writeups/olicyber/challenges/colicyber/misc/byte-flag/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/misc/byte-flag/ Open the PNG in binary mode, locate the ASCII string ‘flag’ in the raw byte stream, and print every byte after that index — the flag is embedded verbatim in the file’s binary content. /writeups/olicyber/challenges/colicyber/web/c-style-login/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/c-style-login/ PHP’s loose comparison treats an array as truthy against any string. Sending password[] as an array in the POST body bypasses the string comparison and grants access. /writeups/olicyber/challenges/colicyber/net/chaos/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/net/chaos/ Filter a PCAP for TCP packets, decode each packet’s payload from hex, and concatenate them in order — the resulting byte stream contains the flag. /writeups/olicyber/challenges/colicyber/web/click-me/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/click-me/ The app tracks clicks with an integer cookie. Skip the clicking by setting ‘cookies’ to 10000000 directly and request the page — the server trusts the cookie value and returns the flag. /writeups/olicyber/challenges/colicyber/binary/coffee-hash/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/coffee-hash/ Model a cyclic windowed hash as a system of linear equations over integer variables and solve it with Z3 to recover the flag. /writeups/olicyber/challenges/colicyber/web/confuse-me/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/confuse-me/ PHP’s loose == treats any string starting with ‘0e’ followed by digits as the float 0. Pass a known magic hash input whose MD5 begins with 0e to bypass a hash comparison. /writeups/olicyber/challenges/colicyber/web/cookiemonster/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/cookiemonster/ The session cookie is a URL-encoded base64 of a JSON string like ‘id-role-username’. Decode it, change the role to 0 and username to admin, re-encode, and access the admin page. /writeups/olicyber/challenges/colicyber/misc/corrupted-flag/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/misc/corrupted-flag/ The GIF has wrong magic bytes at the start. Replace the first 13 bytes with the correct GIF89a header, open the repaired file with Pillow, and iterate through frames saved as WebP to find the flag. /writeups/olicyber/challenges/colicyber/binary/crackmat/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/crackmat/ Each flag character satisfies an independent quadratic equation in integer form; Z3 solves all 20 simultaneously to recover the flag. /writeups/olicyber/challenges/colicyber/misc/dashed/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/misc/dashed/ Decode a Morse code file, strip hex prefixes, convert to binary, interpret as Base64, then apply a Caesar shift derived from the first character — five transforms chained together. /writeups/olicyber/challenges/colicyber/binary/doge-ransom-2/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/doge-ransom-2/ Overflow the IBAN field to leak the binary’s own password via puts, then re-login as ADMIN using the leaked credential and repeat the overflow to reach the flag path. /writeups/olicyber/challenges/colicyber/binary/doge-ransom/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/doge-ransom/ The IBAN input field copies 28 bytes into a buffer with room for 49. Appending the control byte 0x03 after the valid IBAN data overflows into an adjacent flag variable and unlocks the ransomware payment path. /writeups/olicyber/challenges/colicyber/binary/emergency-call/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/emergency-call/ Write /bin/sh into a known writable address, then build a ROP chain that sets rax=59, rdi=/bin/sh, rsi=0, rdx=0 using dedicated pop gadgets and a syscall instruction to get a shell. /writeups/olicyber/challenges/colicyber/web/flags-shop/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/flags-shop/ The buy endpoint accepts a ‘costo’ (price) POST parameter from the client. Sending costo=0 purchases the expensive flag item for free. /writeups/olicyber/challenges/colicyber/binary/formatted/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/formatted/ Use a format string %n write to overwrite a target variable at a known address and unlock the flag path. /writeups/olicyber/challenges/colicyber/binary/generatore-poco-casuale/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/generatore-poco-casuale/ The binary leaks a runtime stack address disguised as a ‘random number’. Add 6 to land inside the shellcode region, then spray that address 800 times to cover the return target and get a shell. /writeups/olicyber/challenges/colicyber/binary/guess-the-number-2/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/guess-the-number-2/ Build a ROP chain that calls gets twice to plant arbitrary data in the GOT, redirect strcspn to a shellcode stub, then trigger the win print path. /writeups/olicyber/challenges/colicyber/binary/guess-the-number/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/guess-the-number/ Overflow the name buffer to corrupt the internal number variable, then feed back the overflowed value as a decimal integer to satisfy the equality check. /writeups/olicyber/challenges/colicyber/web/headache/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/headache/ The flag is not in the response body — it is stored in a custom HTTP response header called ‘Flag’. Use a HEAD request and read r.headers[‘Flag’]. /writeups/olicyber/challenges/colicyber/web/i-got-magic/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/i-got-magic/ Craft a file that is simultaneously a valid GIF (magic bytes GIF89a) and a PHP shell (<?php echo system(‘cat /flag.txt’); ?>). Upload it via the image upload form, find the timestamped filename in the response, and request that URL to execute the shell. /writeups/olicyber/challenges/colicyber/web/just-a-reminder/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/just-a-reminder/ The login form runs client-side JS. Deobfuscating or inspecting it reveals a hardcoded secret key used to AES-decrypt the flag — the key is plaintext at the top of the obfuscated script. /writeups/olicyber/challenges/colicyber/web/light-or-dark/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/light-or-dark/ The theme parameter appends .css to the user-supplied path before serving it. Use …/ triples (which reduce to ../) and a URL-encoded null byte to escape the CSS directory and read /flag.txt. /writeups/olicyber/challenges/colicyber/web/make-a-wish/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/make-a-wish/ Pass the GET parameter as an array (?richiesta[]=sas) to make PHP receive an array instead of a string, bypassing the string equality check and revealing the flag. /writeups/olicyber/challenges/colicyber/binary/more-private-club/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/more-private-club/ Overflow a stack buffer to overwrite the return address with a known win function address, then trigger it. /writeups/olicyber/challenges/colicyber/web/no-robots-here/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/no-robots-here/ robots.txt lists a Disallow path that the crawler is never supposed to visit. That path contains the flag. /writeups/olicyber/challenges/colicyber/web/no-time/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/no-time/ A WAF strips forbidden SQL keywords. Inject OFFSET inside reserved words (SELECT → SELOFFSETECT) so after the WAF removes OFFSET the original keyword is reconstructed, landing a UNION SELECT to dump the flag. /writeups/olicyber/challenges/colicyber/web/password-changer-3000/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/password-changer-3000/ The password-reset token is simply the base64 encoding of the username. Encoding ‘admin’ and passing it as the token query parameter triggers the admin password change flow and reveals the flag. /writeups/olicyber/challenges/colicyber/net/quantum-transport-layer/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/net/quantum-transport-layer/ The TLS server returns the flag as the negotiated ALPN protocol name. Inject the server’s hostname into /etc/hosts, connect with gnutls-cli specifying –alpn=flag, and read the flag from the TLS handshake output. /writeups/olicyber/challenges/colicyber/binary/readdle/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/readdle/ Inject a 4-byte stub shellcode that calls read to pull a full shell payload into the same buffer, then jump to it — bypassing the initial 4-byte size constraint on the first write. /writeups/olicyber/challenges/colicyber/web/rick-roller/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/rick-roller/ The /get_flag.php endpoint immediately redirects the browser to a Rick Astley video. Disabling redirect following in requests reveals the 302 response body which contains the flag. /writeups/olicyber/challenges/colicyber/binary/secret-vault/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/secret-vault/ Trigger a heap allocation that the binary prints, compute the shellcode landing address at heap+96, then overflow the stack with that return address followed by shellcode to get a shell. /writeups/olicyber/challenges/colicyber/web/shells-revenge-2/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/shells-revenge-2/ Upload a GIF polyglot containing a PHP shell, then trigger its execution through a local file inclusion vulnerable ?page= parameter that includes the uploaded file path. /writeups/olicyber/challenges/colicyber/web/shells-revenge/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/shells-revenge/ Upload a file starting with the GIF89a magic bytes followed by a PHP shell. The server validates MIME type from the header but saves the file where PHP can execute it. Access the uploaded file URL to run arbitrary commands. /writeups/olicyber/challenges/colicyber/web/sito-vuoto/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/sito-vuoto/ The homepage appears empty, but the flag is embedded in an HTML comment or inside one of the linked static files (CSS or JS). Fetch each resource and grep for the flag pattern. /writeups/olicyber/challenges/colicyber/web/sn4ck-sh3nan1gans/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/sn4ck-sh3nan1gans/ The server reads a base64-encoded JSON cookie containing an ID field and passes it unsanitised into a SQL query. Inject a UNION SELECT payload inside the JSON, re-encode as base64, and set the forged cookie to extract the flag in three phases. /writeups/olicyber/challenges/colicyber/net/sniff-n-byte/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/net/sniff-n-byte/ The flag is encoded as concatenated 0x-prefixed hex bytes embedded directly in the capture. Strip the prefixes, decode with bytes.fromhex, and print. /writeups/olicyber/challenges/colicyber/net/ssa0x42/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/net/ssa0x42/ Two known-plaintext byte sequences (k and l) from the PCAP header XOR to reveal the repeating key. XOR the encrypted flag block with that key to recover the plaintext. /writeups/olicyber/challenges/colicyber/misc/suoni-misteriosi/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/misc/suoni-misteriosi/ A WAV file carries the flag in Morse code audio. Decode it automatically with morse-audio-decoder and wrap the result in flag{…}. /writeups/olicyber/challenges/colicyber/binary/super-market/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/super-market/ Pass a negative quantity to an unsigned arithmetic check, causing integer underflow that bypasses a balance validation and grants access to a premium item. /writeups/olicyber/challenges/colicyber/binary/terminator/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/binary/terminator/ Overwrite the canary’s null byte to leak the full 8-byte cookie over printf, simultaneously leak a saved RBP to base the stack, then use puts@got to find libc base and call system(‘/bin/sh’) — all in two trips through the same vulnerable function. /writeups/olicyber/challenges/colicyber/net/thats-a-lot-of-fs/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/net/thats-a-lot-of-fs/ Filter Ethernet frames with EtherType 0xffff — the custom protocol used by this challenge — collect the destination MAC address from each matching frame, interpret the first two hex bytes as ASCII, and concatenate to reveal the flag. /writeups/olicyber/challenges/colicyber/web/time-is-key/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/time-is-key/ The server compares the submitted flag character-by-character and returns a response proportional to how many correct characters were prefixed. Measure elapsed time per candidate character and pick the one with the longest response time to recover the flag byte by byte. /writeups/olicyber/challenges/colicyber/web/timp/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/timp/ A POST endpoint executes a shell command with user-supplied input but filters spaces, the word ‘echo’, and other shell metacharacters. Bypass with ${NULL} (strips to nothing) and ${IFS} (the internal field separator, expands to a space in bash). /writeups/olicyber/challenges/colicyber/web/truly-random-signature/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/web/truly-random-signature/ The server issues session tokens that are predictable or reusable. Requesting the site twice, comparing the Set-Cookie headers, and identifying the pattern allows forging or reusing an admin-level token. /writeups/olicyber/challenges/colicyber/net/useless/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/net/useless/ Run strings on the PCAPNG and grep for ‘flag’ — the flag is stored as plain ASCII inside the capture file and visible without any packet parsing. /writeups/olicyber/challenges/colicyber/misc/villa-pisani/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/misc/villa-pisani/ Navigate a DNS-based labyrinth by following CNAME records in four compass directions (up/down/left/right) and reading TXT records until one contains the flag. Depth-first search with a visited set prevents loops. /writeups/olicyber/challenges/colicyber/net/wordwang/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/net/wordwang/ The server returns a word from a custom protocol. Wrap the response in the expected format — prepend ‘?’, uppercase, append ‘!’ — send it back, and the server returns the flag. /writeups/olicyber/challenges/colicyber/net/you-complete-me/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/net/you-complete-me/ A sorted word list and a known sequence of binary-search response sizes pin down a unique word character by character. Reconstruct it by matching the precounted word counts at each prefix level. /writeups/olicyber/challenges/colicyber/misc/zipception-2/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/misc/zipception-2/ 100 nested password-protected ZIPs. Crack each archive’s password against the rockyou wordlist, extract, delete, and repeat — 100 times. /writeups/olicyber/challenges/colicyber/misc/zipception/ Mon, 01 Jan 2024 00:00:00 +0000 /writeups/olicyber/challenges/colicyber/misc/zipception/ A flag is hidden inside 3000 recursively nested ZIP archives. Loop backwards from flag3000.zip to flag1.zip, extracting and deleting each archive in turn until the innermost file is revealed. /archives/ Mon, 01 Jan 0001 00:00:00 +0000 /archives/ archives /search/ Mon, 01 Jan 0001 00:00:00 +0000 /search/ search