picoCTF - Web Exploitation
picoCTF web-exploitation challenge writeups.
Credential Stuffing
picoCTF Credential Stuffing writeup using leaked credential databases to automate login attempts and gain unauthorized access to the target application.
Fool the Lockout
picoCTF Fool the Lockout writeup bypassing a rate-limiting lockout mechanism to brute-force credentials and access the protected endpoint.
Hashgate
picoCTF Hashgate writeup exploiting an IDOR vulnerability where user IDs are hashed with MD5, allowing access to other users accounts by predicting hash values.
No FA
picoCTF No FA writeup exploiting Flask session cookie vulnerabilities to leak OTP codes and crack passwords for authentication bypass.
Secret Box
picoCTF Secret Box writeup exploiting SQL injection to forge authentication tokens and access the secret content containing the flag.
Sql Map1
picoCTF SQL Map 1 writeup using sqlmap to automate SQL injection attacks and extract password hashes, then cracking them with MD5 lookup.