OmniCTF 2026 Quals Web Writeup: 2 Challenges Solved
OmniCTF 2026 Quals shipped a web track built around two recurring lessons: the “debug” field that made it to production, and the disabled-beta button that isn’t actually disabled server-side. Both challenges also come with a loud misdirection designed to burn most of the CTF window (Ganzir advertises HTTP request smuggling via response headers around /employee; StayWild dangles a client-side innerHTML sink at the visitor-notes widget). The intended chains are mundane by comparison, which is the point: trained triage means checking the boring-looking helper before chasing the noisy channel. ...