Mshadow4shell

You walk through a door using an identity you forged

The server fetches something internal on your behalf

You gave yourself access the system never intended to grant

A credential meant for someone else ends up in your hands

Something was left exposed that shouldn't be public

What is the flag obtained from the debug admin panel accessed through secrets leaked in the exposed git commit history?

If you’ve made it through the last door, it’s time to search for the treasure hidden within.

Broken authentication is an invitation to attackers to walk right in. You don’t need to break the front door, it’s already unlocked.

Feeling unwell? A doctor uses an injection. Some systems react similarly when prodded the right way.

User “daniel” seems innocent enough, but not everyone takes security seriously, and he’s no exception.

Look beyond what the app shows you to uncover the first flag.

After successfully escalating privileges on the target, you read /root/flag.txt. Which flag is the final (root) flag?

A hidden host is running a misconfigured service, after exploiting it and gaining access, what is the flag?

While exploring ctf2.playground.ine, you examine the application folder. Which flag is found there?

You've gained access to the host ctf.playground.ine. What is the first flag you discover on that machine?

When the mechanism meant to verify trust is deceived, what final secret comes to light?

In the subtle art of tampering with token headers, what forbidden message is uncovered?

When your token unexpectedly elevates its privileges, what hidden flag is revealed?

Some tokens carry secrets that should never be revealed. What hidden truth emerges?

Data is only as secure as its weakest link. Can you uncover information that shouldn't be accessible?