Writeups on L3B4nk4https://blog.b4nk4.tech/categories/writeup/Recent content from L3B4nk4Hugoen-usAll articles on this blog are licensed under the BY-NC-SA license agreement unless otherwise stated. Please indicate the source when reprinting!Sun, 09 Aug 2026 00:00:00 +0200Tired of Runninghttps://blog.b4nk4.tech/post/tired-of-running/Sun, 09 Aug 2026 00:00:00 +0200https://blog.b4nk4.tech/post/tired-of-running/ Tired of Running

Author: L3B4nk4()

A Go web challenge: a uint16 length-wrap in a custom serializer desynchronizes backend parsing, leading to login bypass, osquery table abuse, inline YARA credential leakage, and a final internal request-splitting trick to recover the flag.

Published on 2026-08-09 at L3B4nk4, last modified on 2026-08-09

]]>writeupPython Suckshttps://blog.b4nk4.tech/post/python_sucks/Sat, 13 Sep 2025 00:00:00 +0200https://blog.b4nk4.tech/post/python_sucks/ Python Sucks

Author: L3B4nk4()

A Flask challenge from Connectors CTF: SQL injection leads to admin access, the file viewer turns into arbitrary file read, and the exposed Werkzeug console finishes the box with RCE.

Published on 2025-09-13 at L3B4nk4, last modified on 2026-03-26

]]>writeupI Hate PHPhttps://blog.b4nk4.tech/post/i-hate-php/Wed, 25 Mar 2026 18:49:31 +0200https://blog.b4nk4.tech/post/i-hate-php/ I Hate PHP

Author: L3B4nk4()

I Hate PHP looks like a restricted LFI at first, but the bug is stronger than that because the app uses include(). Once I found a writable file under an allowed path, it turned into RCE.

Published on 2026-03-25 at L3B4nk4, last modified on 2026-03-25

]]>writeupMy name is aykskshttps://blog.b4nk4.tech/post/my-name-is-ayksks/Tue, 09 Dec 2025 15:22:45 +0200https://blog.b4nk4.tech/post/my-name-is-ayksks/ My name is ayksks

Author: L3B4nk4()

This is the challenge where I achieved second blood: XSS → SSRF → RCE.

Published on 2025-12-09 at L3B4nk4, last modified on 2025-12-09

]]>writeupA Very Small Lockerhttps://blog.b4nk4.tech/post/a-very-small-locker/Sun, 16 Nov 2025 10:45:12 +0200https://blog.b4nk4.tech/post/a-very-small-locker/ A Very Small Locker

Author: L3B4nk4()

A web challenge with two paths: an unintended NoSQL injection shortcut, and the intended chain of business logic, XSS, and IDOR.

Published on 2025-11-16 at L3B4nk4, last modified on 2025-11-16

]]>writeup