YPYogeshwar Peelainexploitnotes.hashnode.dev·2h ago · 8 min readBrunnerCTF : Bink Ink WriteupSummary The challenge exposes a firmware update service ("Bink ink update tool v1.0.5") running as brunner_operator inside a Debian container, reachable only through a Squid proxy. The tool accepts te00
YPYogeshwar Peelainexploitnotes.hashnode.dev·2h ago · 7 min readBrunnerCTF - php-2003 WriteupSummary A "Brunnerne Hosting" customer portal exposed a legacy reservation import form that fed user-controlled, base64-encoded data into unserialize(). Getting a flag required chaining three independ00
YPYogeshwar Peelainexploitnotes.hashnode.dev·2h ago · 8 min readBrunnerCTF : WordPressed to Root WriteupOverview The box ships a mostly-stock WordPress 7.0.0 install on PHP 8.2 / Apache, running on a Debian Trixie base image, packaged as a Docker/Kubernetes challenge deployment. Initial access comes thr00
YPYogeshwar Peelainexploitnotes.hashnode.dev·3h ago · 3 min readBrunnerCTF 2026 - Welcome Aboard (Web)Summary The Brunnerne Inc. internal wiki sits behind layered infrastructure. Direct access to /wiki/internal/flag (hinted by robots.txt) returns a hard 403 Access is forbidden. from Kestrel. The platf00
YPYogeshwar Peelainexploitnotes.hashnode.dev·2h ago · 7 min readBrunnerCTF 2026 : Activating Neurons WriteupSummary The challenge ships a single file, activating_neurons.py, defining a small nn.Module called BrunsvigerNet. The model has two linear layers, but forward() only runs the input through the first 00
YPYogeshwar Peelainexploitnotes.hashnode.dev·2h ago · 4 min readBrunnerCTF : Git Gud Writeup (2026)Summary A Flask web app accepts a .tar upload of a "git repository" and runs git status and git log against it to display commit stats. Because the tar is extracted with no validation and real git com00
YPYogeshwar Peelainexploitnotes.hashnode.dev·1h ago · 13 min readBrunnerCTF 2026 : Half Baked WriteupSummary half_baked.py defines a BrunsvigerCake model with six nn.Linear layers, each with real pretrained weights and biases already assigned, but forward() just returns the input untouched - none of 00
YPYogeshwar Peelainexploitnotes.hashnode.dev·1h ago · 6 min readBrunnerCTF 2026 : Magic or Not WriteupSummary The challenge provides four files (Brunner1.jpg, Brunner2.gif, Brunner3.png, Brunner4.bmp) that all report as generic data under file - none of them start with the magic bytes their extension 00
YPYogeshwar Peelainexploitnotes.hashnode.dev·1h ago · 18 min readBrunnerCTF 2026 : The Three Ways WriteupSummary Two connected challenges built around the same Gitea/Drone/rollout-agent environment. The first stage (Flow) gets code execution on the Drone CI runner. The second stage (Feedback / Continuous00
