#NoSQLInjection

2 posts

View all tags
Nov 24, 2025•Cyber Security•
...

Vorpal Masters (Web) - PatriotCTF

This writeup reverses a small license binary from PatriotCTF 2025 to recover the valid key CACI-2025-PatriotCTF. By inspecting the format string, strcmp checks, byte-by-byte comparisons, and a simple arithmetic check on the numeric field, the three segments are revealed and assembled into the final license.

By Rosemary • 3 min readRead writeup
Nov 24, 2025•Cyber Security•
...

🔐 SecureAuth™ (Web) - PatriotCTF

This writeup shows how the SecureAuth™ API in PatriotCTF 2025 could be bypassed using a NoSQL injection trick by sending a password field with a MongoDB operator, allowing instant admin access and revealing the flag.

By Rosemary • 2 min readRead writeup
The Ordinary PlayerThe Ordinary Player
HomePosts & WriteupsMembersContests

© 2025 - 2026 The Ordinary Player. All rights reserved.
Website theme & implementation © Rosemary (blog.rosemary.my.id)