Writeups for some of the BluBank CTF challenges
Four BluBank CTF writeups: 19-digit RSA in a stripped binary, an Android vault that encrypts its own key, and a zero-knowledge proof that leaks.
Latest Posts
No posts match that search.
-
-
A 6-byte packet exhausts memory in Akvorado's BMP server
Akvorado's BMP server sizes its body buffer by subtracting the header size from the length field, in unsigned 32-bit arithmetic. Anything under 6 bytes wraps to about 4 GiB, and eight connections killed the process. CVSS 7.5, GHSA-wr88-h9r3-fqh3.
-
YesWeHack Dojo #54: One Accent Past the Filter
How a byte-versus-character length check and a hand-built JSON string chain into logging in as another account, plus the failed probes that got me there.