Mshadow4shell

What reference is held by the preview worker reached through template execution?

What object-version reference appears when the target preview uses the modified template?

What reference is recorded for the unauthorized addition to the target project's team?

You walk through a door using an identity you forged

The server fetches something internal on your behalf

You gave yourself access the system never intended to grant

A credential meant for someone else ends up in your hands

Something was left exposed that shouldn't be public

What is the flag obtained from the debug admin panel accessed through secrets leaked in the exposed git commit history?

If you’ve made it through the last door, it’s time to search for the treasure hidden within.

Broken authentication is an invitation to attackers to walk right in. You don’t need to break the front door, it’s already unlocked.

Feeling unwell? A doctor uses an injection. Some systems react similarly when prodded the right way.

User “daniel” seems innocent enough, but not everyone takes security seriously, and he’s no exception.

Look beyond what the app shows you to uncover the first flag.

After successfully escalating privileges on the target, you read /root/flag.txt. Which flag is the final (root) flag?

A hidden host is running a misconfigured service, after exploiting it and gaining access, what is the flag?

While exploring ctf2.playground.ine, you examine the application folder. Which flag is found there?

You've gained access to the host ctf.playground.ine. What is the first flag you discover on that machine?

When the mechanism meant to verify trust is deceived, what final secret comes to light?

In the subtle art of tampering with token headers, what forbidden message is uncovered?

When your token unexpectedly elevates its privileges, what hidden flag is revealed?

Some tokens carry secrets that should never be revealed. What hidden truth emerges?

Data is only as secure as its weakest link. Can you uncover information that shouldn't be accessible?

A system's curiosity can sometimes lead it to unexpected places. Can you make it fetch something valuable?

Certain reports are meant for specific eyes only. Can you access what's not meant for you?

Sometimes, what you send isn't what's saved. Can you manipulate the system to reveal what's hidden?

Some users have more privileges than others. Can you find something they shouldn't have left exposed?

A trusted machine offers a backdoor to sensitive data

An internal web prone to leaks holds the credentials to power

The flaw is a map, trace it

Explore the bug and what follows

Discover the valid number to open the door