--- title: "#brunnerctf articles | Hashnode" description: "Explore 10 articles tagged #brunnerctf on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/brunnerctf" --- Tag # #brunnerctf 10 posts · 0 followers [Rudra Ponkshe](https://hashnode.com/@l1tmus) · [Aug 25](https://hashnode.com/posts/the-three-ways/6a8d3588d281a4d8c606965d) ### [The Three Ways](https://blog.realrudrap.dev/the-three-ways?utm_source=hashnode&utm_medium=feed) Poisoning the Pipeline 7 min read · [blog.realrudrap.dev](https://blog.realrudrap.dev/the-three-ways?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 23](https://hashnode.com/posts/brunnerctf-2026-the-three-ways-writeup/6a8b17fec9ed6fd6e84326ef) ### [BrunnerCTF 2026 : The Three Ways Writeup](https://exploitnotes.hashnode.dev/brunnerctf-2026-the-three-ways-writeup?utm_source=hashnode&utm_medium=feed) The Three Ways BrunnerCTF 2026 writeup: exploit Gitea, Drone CI, leaked secrets, and an unsigned rollout agent to gain root access. 18 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/brunnerctf-2026-the-three-ways-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 23](https://hashnode.com/posts/brunnerctf-wordpressed-to-root-writeup/6a8b0fa6caa64e461925ff52) ### [BrunnerCTF : WordPressed to Root Writeup](https://exploitnotes.hashnode.dev/brunnerctf-wordpressed-to-root-writeup?utm_source=hashnode&utm_medium=feed) BrunnerCTF WordPressed to Root walkthrough covering WordPress RCE, CVEs, sudo chroot exploitation, NSS injection, privilege escalation, and root. 8 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/brunnerctf-wordpressed-to-root-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 23](https://hashnode.com/posts/brunnerctf-php-2003-writeup/6a8b0bd013d6c9e2a997446f) ### [BrunnerCTF - php-2003 Writeup](https://exploitnotes.hashnode.dev/brunnerctf-php-2003-writeup?utm_source=hashnode&utm_medium=feed) BrunnerCTF PHP-2003 walkthrough covering PHP object injection, magic hashes, soft-hyphen bypass, duplicate properties, unserialize, and destructors. 7 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/brunnerctf-php-2003-writeup?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/brunnerctf-php-2003-writeup/6a8b0bd013d6c9e2a997446f) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 23](https://hashnode.com/posts/brunnerctf-bink-ink-writeup/6a8b0d7941d4c4c3387c3d32) ### [BrunnerCTF : Bink Ink Writeup](https://exploitnotes.hashnode.dev/brunnerctf-bink-ink-writeup?utm_source=hashnode&utm_medium=feed) BrunnerCTF Bink Ink walkthrough covering proxy access, path traversal, arbitrary file write, sudo abuse, SquashFS payloads, and root escalation. 8 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/brunnerctf-bink-ink-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 23](https://hashnode.com/posts/brunnerctf-2026-welcome-aboard-web/6a8b0862909a2dfef246921a) ### [BrunnerCTF 2026 - Welcome Aboard (Web)](https://exploitnotes.hashnode.dev/brunnerctf-2026-welcome-aboard-web?utm_source=hashnode&utm_medium=feed) BrunnerCTF walkthrough covering CL.TE request smuggling, Kestrel, proxy desync, path authorization bypass, and accessing the internal wiki flag. 3 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/brunnerctf-2026-welcome-aboard-web?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 23](https://hashnode.com/posts/brunnerctf-2026-magic-or-not-writeup/6a8b1960e84c0d73dade1301) ### [BrunnerCTF 2026 : Magic or Not Writeup](https://exploitnotes.hashnode.dev/brunnerctf-2026-magic-or-not-writeup?utm_source=hashnode&utm_medium=feed) Magic or Not BrunnerCTF 2026 writeup: crack single-byte XOR using image magic bytes, decode four slices, and stitch them to recover the flag. 6 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/brunnerctf-2026-magic-or-not-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 23](https://hashnode.com/posts/brunnerctf-git-gud-writeup-2026/6a8b1219fb8f3d1521b65327) ### [BrunnerCTF : Git Gud Writeup (2026)](https://exploitnotes.hashnode.dev/brunnerctf-git-gud-writeup-2026?utm_source=hashnode&utm_medium=feed) Exploit an attacker-controlled .git/config through core.fsmonitor to achieve server-side RCE and leak the flag via Git status output. 4 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/brunnerctf-git-gud-writeup-2026?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 23](https://hashnode.com/posts/brunnerctf-2026-half-baked-writeup/6a8b1ada81bd53a5193f57f7) ### [BrunnerCTF 2026 : Half Baked Writeup](https://exploitnotes.hashnode.dev/brunnerctf-2026-half-baked-writeup?utm_source=hashnode&utm_medium=feed) Half Baked BrunnerCTF 2026 writeup: reconstruct a PyTorch model, chain six layers, restore ReLU activations, and decode the hidden flag. 13 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/brunnerctf-2026-half-baked-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Aug 23](https://hashnode.com/posts/brunnerctf-2026-activating-neurons-writeup/6a8b15b11a91f30337f55008) ### [BrunnerCTF 2026 : Activating Neurons Writeup](https://exploitnotes.hashnode.dev/brunnerctf-2026-activating-neurons-writeup?utm_source=hashnode&utm_medium=feed) Recover a hidden flag from a crippled PyTorch model by restoring a missing layer in forward() and decoding its ASCII output for BrunnerCTF 2026. 7 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/brunnerctf-2026-activating-neurons-writeup?utm_source=hashnode&utm_medium=feed)