Shubh's Corner
= Code, Create, Repeat =
Shubh
I write about development, tech, security, and little trinkets of what I enjoy
Posts
Writeup for Six Ways Out from KPMG CTF 2026. Forensic network and endpoint investigation across six covert exfiltration channels: HTTP, DNS, SMTP, ICMP, FTP, and WebSockets.
Writeup for TradeBot from KPMG CTF 2026. Exploiting a race condition in an MCP-based trading API to trigger settlement oversubscription and leak a restricted instrument's flag.
Writeup for Troll Clock from KPMG CTF 2026. Intercepting WebSocket verification logic and reversing obfuscated JavaScript proxy calculations to extract the flag.
Writeup for Vision from KPMG CTF 2026. Repairing a corrupted JPEG disguised with a fake PNG header, adjusting SOF dimensions, and decoding Morse code encoded in word lengths.
Writeup for Voodoo Spirit of Death (Parts 1 & 2) from KPMG CTF 2026. Unauthenticated Redis leaking SSH credentials, followed by CVE-2021-3156 (Baron Samedit) to get root.
