


Hands-on exploitation lab for Roundcube Webmail CVE-2025-49113 (authenticated PHP object deserialization → RCE) to read /secret.txt.

Raspberry Pi RP2350 hacking challenge: extract a 128-bit OTP secret protected by secure boot and OTP lock, with setup scripts and firmware for Pico 2…

Command line tool to fetch, decode, brute-force and craft session cookies of a Flask application by guessing secret keys.

Files + Writeups for DownUnderCTF 2022 Challenges

JWT Key Confusion PoC (CVE-2015-9235) Written for the Hack the Box challenge - Under Construction