Blog
Search
Featured posts
L3akCTF 2026 - Squid
A complex server-side web challenge showing off some parser differentials and a new technique. It was followed by a really interesting race condition technique involving file descriptors to read environment variables in Flask.
Finding XSS on Shazzer (literally)
How I found an XSS in Shazzer, a tool for discovering and sharing browser quirks through fuzzing. Not *using*, but *in* Shazzer. We'll explore some useful techniques with Blob URLs to unsandbox malicious content.
openECSC 2025 - kittychat-secure
Overcomplicating a hard client-side web challenge involving complex CSP script gadgets. Exploit Math.random() predictability, and learn how to use the Connection Pool to make Race Conditions easier.
Nonce CSP bypass using Disk Cache
The solution to my small XSS challenge, explaining a new kind of CSP bypass with browser-cached nonces. Leak it with CSS and learn about Disk Cache to safely update your payload