Writeups

Writeups from CTF challenges and lab-based security research, focused on web exploitation and identity and cloud attack paths. By day I work on Microsoft identity and detection and response; these are offensive-side exercises.

Everything here is CTF or authorized-lab work. No real-world targets, credentials or findings are published. The originals live in GrantZero604/security-writeups on GitHub, licensed CC BY 4.0.

CTF writeups

• 401 Authorized BetaHKCERT CTF 2026 qualifier · Web / Business Logic, SQL Injection, Weak Randomness · 2026-11Three bugs in one HKCERT CTF 2026 challenge: a token leaked on the denial path, a published 16-bit LCG and SQLi through PyMySQL %-substitution.Techniques: Token leaked on the denial path · PyMySQL %-substitution smuggling · Published LCG parameters · Controls on fresh state · Validating an extractor before trusting its silence
• Halloween Store1st place write-up, Intigriti CTF 1026Intigriti CTF 1026 · Web / Business Logic · 2026-10A coupon guard that remembers one code, not the set: alternate two public codes for 100% off. Intigriti CTF 1026 business-logic writeup.Techniques: Impossible-rendered-state tell · Stale last-coupon comparison vs a toggling coupon pair · Reconstructed server model validated against live observations · Real captured request/response replay · Percentage stack floors at 0, not a refund
• Critter GalleryIntigriti CTF 0926 · Web / SQL Injection · 2026-09A base64-wrapped parameter, a blank-response error oracle and a union-based SQL injection into a hidden table. Intigriti CTF 0926.Techniques: Base64-wrapped injection point · Union-based SQLi · Blank-response error oracle · MySQL hex literals · group_concat() schema dump
• Bad ReceptionIntigriti CTF 0826 · Web / XSS · 2026-08Stored XSS in a moderator bot: a DOMPurify ADD_TAGS gap, a script-src 'self' CSP and a same-origin JSONP gadget. Intigriti CTF 0826.Techniques: DOMPurify ADD_TAGS bypass · CSP script-src 'self' same-origin bypass · JSONP callback gadget · Missing X-Content-Type-Options: nosniff (MIME execution) · Stored XSS via headless bot

Halloween Store took first place out of 72 write-ups in Intigriti’s October 2026 challenge. It also has an interactive edition where the coupon model runs in your browser.

401 Authorized Beta (HKCERT CTF 2026) also has an interactive edition where each guard runs as a model in your browser.

Methodology

• OAuth2 / OIDC discovery playbookMethodology · Web / Identity · 2026-10Read-only OAuth2 and OpenID Connect recon: discovery metadata, provider fingerprints, flow classification, PKCE and redirect_uri tests.Techniques: Reading the discovery document · Provider fingerprinting (Entra ID, Okta, Keycloak, Auth0, Duende, Cognito) · Flow classification · PKCE · redirect_uri and state misconfigurations · Reporting