root@cyber:~$ls -la ./writeups/

CTF Writeups

A collection of my capture-the-flag competition writeups, organized by platform and CTF event.

//Platforms

TryHackMe

27 writeups

Guided learning platform with hands-on labs.

→

//CTF Competitions

//All Writeups

TryHackMeMedium2026-1-04

No Name CTF - TryHackMe Writeup

Room

No Name CTF- TryHackMe Writeup

#TryHackMe #CTF #Boot2Root #PrivEsc

TryHackMeMedium2026-02-16

Corp Website - TryHackMe Writeup | React2Shell RCE to Root

Room

Corp Website TryHackMe writeup — Love At First Breach 2026: CVE-2025-55182 React2Shell unauthenticated RCE, Dockerfile leak, and sudo python3 privilege escalation.

#TryHackMe #Love At First Breach #LABCTF #CTF #React Server Components #CVE-2025-55182 #RCE #Privilege Escalation #Red Team

TryHackMeEasy2026-02-16

CupidBot - TryHackMe Writeup | LLM Prompt Injection to Three Flags

Room

CupidBot TryHackMe writeup — Love At First Breach 2026: prompt injection, system prompt leakage, and role impersonation to capture all three flags.

#TryHackMe #Love At First Breach #LABCTF #CTF #Prompt Injection #LLM #AI Security #Red Team

TryHackMeEasy2026-02-16

Cupid's Matchmaker - TryHackMe Writeup | Stored XSS to Admin Bot Flag Theft

Room

Cupid's Matchmaker TryHackMe writeup — Love At First Breach 2026: stored XSS in survey, admin bot review, and exfiltration of /flag to capture the flag.

#TryHackMe #Love At First Breach #LABCTF #CTF #Stored XSS #Admin Bot #Exfiltration #Red Team

TryHackMeEasy2026-02-16

Hidden Deep Into my Heart - TryHackMe Writeup | Robots.txt to Secret Vault

Room

Hidden Deep Into my Heart TryHackMe writeup — Love At First Breach 2026: robots.txt disclosure, directory fuzzing, and default credentials to Cupid's secret vault flag.

#TryHackMe #Love At First Breach #LABCTF #CTF #robots.txt #Directory Enumeration #Default Credentials #Red Team

TryHackMeEasy2026-02-16

Love Letter Locker - TryHackMe Writeup | IDOR to Read Other Users' Letters

Room

Love Letter Locker TryHackMe writeup — Love At First Breach 2026: predictable letter IDs and missing ownership check leading to IDOR and flag.

#TryHackMe #Love At First Breach #LABCTF #CTF #IDOR #Access Control #Authorization Bypass #Red Team

TryHackMeMedium2026-02-16

Signed Messages - TryHackMe Writeup | Deterministic RSA Key Recovery

Room

Signed Messages TryHackMe writeup — Love At First Breach 2026: LoveNote deterministic RSA, /debug key leak, and PSS signature forgery to capture the flag.

#TryHackMe #Love At First Breach #LABCTF #CTF #RSA #Cryptography #Deterministic Key #PSS #Red Team

TryHackMeEasy2026-02-16

Speed Chatting - TryHackMe Writeup | Unrestricted File Upload to RCE

Room

Speed Chatting TryHackMe writeup — Love At First Breach 2026: profile picture upload, Python reverse shell, and root RCE to capture the flag.

#TryHackMe #Love At First Breach #LABCTF #CTF #File Upload #RCE #Python #Reverse Shell #Red Team

TryHackMeEasy2026-02-16

TryHeartMe - TryHackMe Writeup | JWT Cookie Tampering to Admin Shop

Room

TryHeartMe TryHackMe writeup — Love At First Breach 2026: JWT decode, role tampering without re-signing, and access to hidden ValenFlag for the flag.

#TryHackMe #Love At First Breach #LABCTF #CTF #JWT #Authentication Bypass #Privilege Escalation #Red Team

TryHackMeMedium2026-02-16

Valenfind - TryHackMe Writeup | Path Traversal to Admin API

Room

Step-by-step Valenfind TryHackMe writeup from Love At First Breach CTF 2026: LFI path traversal, Flask app source leak, and admin API key leading to the flag.

#TryHackMe #Love At First Breach #LABCTF #CTF #Path Traversal #LFI #Flask #Red Team

TryHackMeMedium2026-02-16

When Hearts Collide - TryHackMe Writeup | MD5 Collision to Match Flag

Room

When Hearts Collide TryHackMe writeup — Love At First Breach 2026: MD5 match logic flaw, generic collision with fastcoll, and flag from duplicate-hash match.

#TryHackMe #Love At First Breach #LABCTF #CTF #MD5 #Hash Collision #fastcoll #Red Team

TryHackMeMedium2026-02-04