Skip to content

Instantly share code, notes, and snippets.

View zeinitsu03's full-sized avatar

zeinitsu03

View GitHub Profile
@zeinitsu03
zeinitsu03 / intigriti_0726_writeup.md
Last active August 30, 2026 14:11
Writeup for my Intigriti_0726_ctf

Intigriti 0726 CTF: Authorization Bypass via Duplicate JSON Keys

Overview

The challenge application, Canonically Yours, generates read-only compatibility reports from signed package manifests.

Each registered user receives a private namespace. The server is expected to approve manifests only when the requested package belongs to that namespace.

I found an interpretation conflict between the manifest approval and publication stages. A JSON manifest containing two top-level package members is authorized using the first member but published using the second member.

@zeinitsu03
zeinitsu03 / leaky_jar_csrf_writeup.md
Last active June 30, 2026 09:51
CSRF to Persistent Admin Vault Access

Leaky Jar: CSRF Grants Persistent Access to the Master Baker’s Private Recipe Box

Challenge: Intigriti Leaky Jar
Researcher: zeinitsu12
Tested browser: Current Google Chrome
Attacker account: iamtester
Vulnerability: Cross-Site Request Forgery — CWE-352
Affected endpoint: POST /share