Web

CSAW CTF Quals 2026: eight writeups across Web, Forensics, OSINT, and Misc, from JWT x5c forgery and a Caddy forward-auth bypass to pixel steganography and a three-platform OSINT chase

PwnSec CTF 26: two easy web solves, a boolean blind SQLi built on a PHP type-confusion crash, and a pickle sandbox escape using OBJ instead of REDUCE

HTB Web challenge — Admin registration, 4-digit brute force, and Local File Inclusion via PhantomJS PDF rendering