BDSec CTF 2026’s web track shipped two challenges that sit at opposite ends of the difficulty scale but share the same root failure: the server trusts a client-controlled field to govern a security decision. Admin Portal (50 pts) trusts the alg field inside the client-supplied JWT header to decide which signature algorithm to enforce — the client says alg: none, the server skips signature verification entirely, and a payload with role=admin walks through the front door. Ticketly (425 pts) trusts a client-controlled ticket body after applying a blacklist sanitiser — the sanitiser blocks <script>, <iframe>, <img>, javascript:, and onload, but allows SVG SMIL animation elements including the onbegin event attribute, which executes JavaScript automatically in any browser that renders the page. An admin bot opens the reported ticket, the animation fires, and document.cookie (which holds the flag) is exfiltrated to a webhook in chunked POST bodies. ...
BDSec CTF 2026’s pwn track shipped two 100-point challenges that both hinge on the same class of bug — two components of the same program disagree about the meaning of one operation — but at completely different levels of the stack. Phantom Device is a menu-driven device-driver simulator where the duplicate handle operation copies the descriptor but does not update the object refcount, so release and duplicate disagree about how many live pointers exist. That mismatch drops a stale device handle over a session-object allocation and gives a read/write primitive that leaks the process cookie and forges the privileged role. Muktir Shongket is a custom-bytecode terminal where the verifier and the executor disagree about what a ROUTE order does: the verifier walks past it as metadata, the executor translates it into an x86 jmp rel32. That jump lands inside a later SIGNAL literal, whose bytes were never inspected as instructions, and calls the internal flag.txt printer at a fixed address in the non-PIE binary. ...
BDSec CTF 2026 shipped a three-challenge reverse-engineering track that runs the classic escalator: Easy RE Challenge (80 pts) is an unstripped ELF with four input paths, three of them decoys with convincing AFLAG/BFLAG/CFLAG{...} returns, and one real 41-byte BDSEC{...} branch guarded by a per-byte XOR + rotate-left + additive-term + output-permutation transform that inverts cleanly from the embedded expected buffer. Night Shift (100 pts) is a stripped ELF that spawns five pthread workers and dispatches them from the user’s eight-token “shift code”; only 5^8 = 390 625 orderings exist, and exactly one matches the four 32-bit state targets plus the FNV-shaped hash accumulator, unlocking a .rodata printer that emits the flag byte by byte. Borrowed Memory (460 pts) is a stripped PIE that generates a 0x800-byte xorshift-seeded memory table, patches specific offsets to encode a 12-step VM opcode tape, and asks the user for twelve 16-bit offsets that walk that tape with checksum-gated transitions — after the twelfth step drops off the end of the table (next-offset = 0xFFFF), a four-source XOR loop decrypts a 40-byte .rodata blob into the real flag. ...
OmniCTF 2026 Quals shipped a misc track that runs the full skill spectrum, plus a rich forensics challenge that pairs naturally with it: baccarat (game theory / Kelly criterion + reconnect loop), Node (Node-RED unauth RCE chained to a SUID DT_RUNPATH shared-library hijack for root), nostalgia (nested container parsing from Scratch .sb3 to a RISC-V Linux kernel to a newc cpio to a text file), Sanity P0zzl3 (computer vision + constraint programming: 100 transparent PNG jigsaw pieces of a shuffled QR code solved as a 10x10 assignment problem, then morphological repair to decode), and QuackQuackDiriDiriDuck (forensics: a 2023-05-24 Qakbot/OBAMA264 infection PCAP with 10 sub-question flags reconstructed from tshark HTTP object export, JA3/JA4 no-SNI fingerprints identifying the four TLS C2 endpoints, and UTC timestamp reconciliation against Brad Duncan’s malware-traffic-analysis.net ground-truth notes). What ties them together is a single discipline: the handout is the oracle. baccarat’s game.py simulates its own agents. Node’s /entrypoint.sh names the misconfiguration. nostalgia’s .sb3 is a ZIP. Sanity P0zzl3’s PNG alpha channels give piece geometry cleanly. QuackQuackDiriDiriDuck’s PCAP filename literally names the malware-traffic-analysis.net corpus entry to cross-reference. Every challenge hands you enough to reconstruct the exploit from first principles. ...
OmniCTF 2026 Quals shipped a game track built entirely around Minecraft, but with two challenges from very different sides of the platform. permissiondenied (medium, 78 points, 93 solves) is a live Paper 1.21.11 server whose custom permission plugin exposes a /demote <index> command; the plugin correctly rejects positive indices above the caller’s rank but computes new_index = current_index - supplied_index on the negative path, so /demote -4 from the default rank at index 3 lands at Admin at index 7. Shibiu (medium, 77 points, 94 solves) is a Minecraft Java world derived from the public “Shibuya (sort of…)” map by Noshiaga/Noshychan; a differential analysis against the original world (filtering volatile NBT fields and correctly decoding the Java Edition block-state palette bit packing) surfaces a strip of dirt → redstone_block edits at y=-62 forming a 5x7 pixel-font banner that spells the flag. ...
OmniCTF 2026 Quals shipped a crypto track built around one recurring lesson: the algebra is scarier than the actual attack surface. Three challenges, all rated medium, and every one dresses a mundane linear-algebra collapse in a costume the reader is expected to spend hours investigating. dual_linera uses two-modulus LWE where the error e is shared across both moduli. CRT is a linear map, so e survives the reconstruction and 18 samples plus LLL on a 20x20 lattice recover the 96-bit secret. Whiskerfield-Meowtin offers a “CuteSecure-DH” whose modulus is 65537^16 (Fermat prime to the 16th power) and whose public value is hand-crafted as one byte-flip away from a multiple of 65537. Patch the byte, drive the shared secret to zero, decrypt under the LCG stream cipher. Orbital-Strike-Cannon wraps a 9-unknown affine state in non-associative octonion multiplication, a published-stream “broken RNG”, and 7 satellites (5 real, 2 fake), but once you fix the association order it becomes 8x8 matrix multiplication, and once you write the samples as linear equations a per-satellite RREF sorts real from fake without needing the private real_ids. ...
OmniCTF 2026 Quals shipped a reverse-engineering track that runs the full spectrum from beginner constraint-solving to a signal-driven VM that uses SIGSEGV and SIGILL as branch instructions. Four challenges: CredVault (medium, 85 solves) is a Parcel-format migration mismatch between two validators over a binary TCP protocol; Gatekeep (medium, 62 solves) is a PNG-only FPGA schematic solved as a byte-level constraint satisfaction problem; Kant (medium, 92 solves) is a stripped Rust binary whose hidden check <hex> mode stacks XOR / S-boxes / MixColumns / power-maps mod 257 / two 16-round Feistels / byte and bit permutations, all reversible from the embedded compare target; Pusher (hard, 500 points, 0 solves at release) is a 32-bit i386 ELF whose control flow is smuggled through installed signal handlers and whose %d vs %c format-string trap costs an entire remote instance to figure out from the wrong side. ...
OmniCTF 2026 Quals shipped a pwn track with two challenges from very different worlds. nullshui (hard, 500 points, 0 solves at release) is glibc 2.39 heap exploitation on Ubuntu 24.04 with every modern mitigation turned on (Full RELRO, canary, NX, PIE, SHSTK, IBT). WinCapture (medium, 111 points, 39 solves) is a Windows kernel-driver TOCTOU race exposed through a named pipe. What they share is a design shape worth noticing: neither one lets you spawn a shell (Ubuntu 24.04 hardening on one side, kernel-mode context on the other both make direct shellcode impractical), neither relies on a stack smash, and the winning primitive in both is a narrow write into carefully-shaped adjacent state that a defender would look at and say “too small to exploit in practice.” ...
OmniCTF 2026 Quals shipped a web track built around two recurring lessons: the “debug” field that made it to production, and the disabled-beta button that isn’t actually disabled server-side. Both challenges also come with a loud misdirection designed to burn most of the CTF window (Ganzir advertises HTTP request smuggling via response headers around /employee; StayWild dangles a client-side innerHTML sink at the visitor-notes widget). The intended chains are mundane by comparison, which is the point: trained triage means checking the boring-looking helper before chasing the noisy channel. ...
The previous article in this series treated $_SERVER['HTTP_HOST'] and friends as “attacker-controlled territory” and moved on. That’s the right operational answer, but it hides an interesting question: how does a request actually reach your PHP handler in the first place, and which layer decides that Host: attacker.com becomes $_SERVER['HTTP_HOST'] = "attacker.com" in your process? ...