A technical writeup of Intigriti's BRP bonus challenge, Pray For Nepal: a DOM-clobbering gadget that passes every check in the client source and still gets an empty 403, because the server enforces a rule the client never applies.

A technical writeup of Intigriti's Challenge 1026, the Halloween Store: a €666 item, €66 of store credit, and a duplicate-coupon check that only ever looks at the last promotion you applied. Shown end to end in Burp Repeater, including the wrong theory I solved it with first.

A technical writeup of Intigriti's Challenge 0926: an unauthenticated UNION-based SQL injection hiding behind a base64-encoded pic parameter in a Critter Gallery. How base64 gets mistaken for a security boundary, how I fingerprinted the query column-by-column, and how one encoded SELECT pulled the flag out of secret_vault.

How a single character missing from an attribute-name blacklist in Vue's SSR renderer lets one object key get parsed by real browsers as three separate HTML attributes, including a self-firing event handler.

A beginner-friendly walkthrough of a hard-tier chain: a template-injection bug you can't reach through the front door, so you smuggle a malicious PHP object into a Redis queue via a CRLF-injected SSRF and let the background worker detonate it into command execution.

A beginner-friendly walkthrough of a three-bug web chain: poisoning a shared cache to plant a payload in a bot's browser, polluting a JavaScript prototype to smuggle settings into jQuery, and stealing the bot's cookie back through the same cache — no attacker server required.

A private-program finding where an API reflected a localhost origin alongside Access-Control-Allow-Credentials, exposing private AI assistant conversations cross-origin — and why the attacker precondition, not the data sensitivity, decided the severity.

The full journey from hunting SSRF guards to finding a validator-vs-connector disagreement in ip-range-check — how abbreviated IPv4 notation bypasses denylist checks affecting ~390k weekly downloads.