Shubh's Corner
= Code, Create, Repeat =
Shubh
I write about development, tech, security, and little trinkets of what I enjoy
Posts
Writeup for AcmeBank Secure Assistant from KPMG CTF 2026. Exploiting missing object-level authorization (BOLA) in an LLM lookup function to dump the admin recovery secret.
Writeup for Arclight (Parts 1 & 2) from KPMG CTF 2026. GraphQL hidden field exposure and a broken object-level authorization bug through nested resolver paths to escalate from standard to root role.
Writeup for Incident Artifacts from KPMG CTF 2026. Forensic investigation of access logs, network packet capture, and image steganography to reconstruct an attacker exfiltration trail.
Writeup for Cloud Health Check from KPMG CTF 2026. Bypassing SSRF URL filters using decimal IP encoding to reach the cloud metadata service.
Writeup for DevNote from KPMG CTF 2026. Leaked guest credentials in HTML comments leading to a developer query interface vulnerable to SQLite injection.
Writeup for Healthy Hijack (Parts 1 & 2) from KPMG CTF 2026. Newline injection through a command allowlist bypass, followed by a world-writable root cron script to escalate to root.
Writeup for Locks of Confusion (Parts 1 & 2) from KPMG CTF 2026. Recovering a weak 2007-era SSH private key from a legacy system archive, then escaping a chroot jail via a misplaced working directory and a setuid helper binary.
Writeup for Onion Layers from KPMG CTF 2026. Peeling through nested encoding layers including binary representation, Base64, hex encoding, and an Atbash cipher.
Writeup for PLCTERM-4 from KPMG CTF 2026. Exploiting an exposed SCADA UART maintenance console, deriving service keys from device telemetry, and extracting flag chunks from diagnostic registers.
Writeup for SecureBot from KPMG CTF 2026. Bypassing confidential access code guardrails using a multi-turn unit test prompt injection.