YYogeshwar Peela·Aug 23BrunnerCTF 2026 : The Three Ways WriteupThe Three Ways BrunnerCTF 2026 writeup: exploit Gitea, Drone CI, leaked secrets, and an unsigned rollout agent to gain root access.18 min read·exploitnotes.hashnode.dev
YYogeshwar Peela·Aug 23BrunnerCTF : WordPressed to Root WriteupBrunnerCTF WordPressed to Root walkthrough covering WordPress RCE, CVEs, sudo chroot exploitation, NSS injection, privilege escalation, and root.8 min read·exploitnotes.hashnode.dev
YYogeshwar Peela·Aug 23BrunnerCTF - php-2003 WriteupBrunnerCTF PHP-2003 walkthrough covering PHP object injection, magic hashes, soft-hyphen bypass, duplicate properties, unserialize, and destructors.7 min read·exploitnotes.hashnode.dev1J
YYogeshwar Peela·Aug 23BrunnerCTF : Bink Ink WriteupBrunnerCTF Bink Ink walkthrough covering proxy access, path traversal, arbitrary file write, sudo abuse, SquashFS payloads, and root escalation.8 min read·exploitnotes.hashnode.dev
YYogeshwar Peela·Aug 23BrunnerCTF 2026 - Welcome Aboard (Web)BrunnerCTF walkthrough covering CL.TE request smuggling, Kestrel, proxy desync, path authorization bypass, and accessing the internal wiki flag.3 min read·exploitnotes.hashnode.dev
YYogeshwar Peela·Aug 23BrunnerCTF 2026 : Magic or Not WriteupMagic or Not BrunnerCTF 2026 writeup: crack single-byte XOR using image magic bytes, decode four slices, and stitch them to recover the flag.6 min read·exploitnotes.hashnode.dev
YYogeshwar Peela·Aug 23BrunnerCTF : Git Gud Writeup (2026)Exploit an attacker-controlled .git/config through core.fsmonitor to achieve server-side RCE and leak the flag via Git status output.4 min read·exploitnotes.hashnode.dev
YYogeshwar Peela·Aug 23BrunnerCTF 2026 : Half Baked WriteupHalf Baked BrunnerCTF 2026 writeup: reconstruct a PyTorch model, chain six layers, restore ReLU activations, and decode the hidden flag.13 min read·exploitnotes.hashnode.dev
YYogeshwar Peela·Aug 23BrunnerCTF 2026 : Activating Neurons WriteupRecover a hidden flag from a crippled PyTorch model by restoring a missing layer in forward() and decoding its ASCII output for BrunnerCTF 2026.7 min read·exploitnotes.hashnode.dev
