3kCTF-2021 From Sat, 15 May 2021, 11:00 UTC to Sun, 16 May 2021, 17:00 UTC Registration is open ctf.the3000.org More details and prizes TBA

We're excited to partner with 1Password for #3kCTF There'll be 1 Free Year of 1Password Families for all participants 2021.ctf.the3000.org

#3kCTF-2021 is over, Thank you for playing ! Final scoreboard: 1- Never Stop Exploiting 2- Black Bauhinia - Black Bauhinia 3- zer0pts - zer0pts 4- greunion - Greunion ⚑ 5- zh3r0

#3kCTF-2021 - ppaste writeup r0.haxors.org/posts?id=15

#3kCTF-2021 my pwn challenges exploits telnet github.com/rekter0/ctf/bl… babyrtos github.com/rekter0/ctf/bl…

Moodle Stored XSS and Blind SSRF i've found earlier this year with Holme r0.haxors.org/posts?id=20

Moodle Blind SQL injection via MNet authentication r0.haxors.org/posts?id=26

Exploiting NFS server via SSRF #HITCON CTF 2021 Metamon-Verse Writeup r0.haxors.org/posts?id=27

impressCMS - unauthenticated code execution r0.haxors.org/posts?id=8

Multiple vulns in vestacp including 2 privesc found with 0xkasper

Blue Water places 2nd place in DEF CON CTF Finals! Blue Water is a merger of perfect blue + Water Paddler + Samsung Research + Tea Deliverers. Thank you to Nautilus Institute for the great CTF, and shoutout to all the other finalists! See you next year? 😉

Thx for hosting such a great CTF. Great team work with perfect blue. Congraz to *0xA and MMM. See you guys in Final!

A twitter content spoofing issue being exploited by same recent Ledger hackers? you can put any username and as long as the tweet id is valid it will be redirected to the correct account. the scam pages drain using same ledger hack contract bytecode 🤔

📝Another fantastic write-up about the Remedy Closed Beta Challenge. Dive into details r0.haxors.org/posts?id=43 Big kudos to rekter0 for this comprehensive breakdown🙏 Curious about and want to give it a shot? Join us on Discord to explore and take part discord.gg/q5kZAH7kN5

Trade onchain with counterparties, not addresses, privately. Finally, a small demo of the Onflow protocol, fully computed proof in zero-knowledge with no internet required. Going live on Base soon, and many other ecosystems. 1-click ZK-KYC, everywhere, imminent✨

Jesse Pollak showing the ease of onboarding with Onflow.

🧵 [1/4] Here is our DOMPurify 3.2.1 bypass, using a namespace confusion technique where each element is initially in a “correct” namespace. When it was allowed, the ‘is’ attribute was not handled correctly, making the attribute content’s regex check obsolete. #mXSS #XSS

Now you know why

I just learned that OSC8 (hyperlinks) in Windows Terminal uses ShellExecute(). Excellent trolling potential for README files 😆

🥈 Thrilled to nab 2nd as Blue Water, teamed up with Luís Henrique Muniz at DEFCON CTF Final 33! 🙌 Congrats to Maple Mallard Magistrates for their 4th straight 1st 💪 We’re gunning for the crown next year! Join our crew to make it happen! DM us or drop us an email! 🚀 #DEFCON #CTF