m4rkh0r

Not everything stored as config should be treated as safe.

Every platform has an entry point. Find it

What is the flag obtained from the debug admin panel accessed through secrets leaked in the exposed git commit history?

If you’ve made it through the last door, it’s time to search for the treasure hidden within.

Broken authentication is an invitation to attackers to walk right in. You don’t need to break the front door, it’s already unlocked.

Feeling unwell? A doctor uses an injection. Some systems react similarly when prodded the right way.

User “daniel” seems innocent enough, but not everyone takes security seriously, and he’s no exception.

Look beyond what the app shows you to uncover the first flag.

While exploring ctf2.playground.ine, you examine the application folder. Which flag is found there?

You've gained access to the host ctf.playground.ine. What is the first flag you discover on that machine?