index.xml

<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
    <channel>
        <title>Root-Me Blog</title>
        <link>https://blog.root-me.org/</link>
        <description>Root Me allows everyone to test and improve their knowledge in computer security and hacking. Legal. Free. Realistic.</description>
        <generator>Hugo -- gohugo.io</generator><language>en</language><managingEditor>contact@root-me.org (Root-Me)</managingEditor>
            <webMaster>contact@root-me.org (Root-Me)</webMaster><lastBuildDate>Wed, 07 May 2025 00:00:00 &#43;0000</lastBuildDate>
            <atom:link href="https://blog.root-me.org/index.xml" rel="self" type="application/rss+xml" />
        <item>
    <title>Writeup - DGSE Recruitment CTF</title>
    <link>https://blog.root-me.org/posts/writeup_dgse/</link>
    <pubDate>Wed, 07 May 2025 00:00:00 &#43;0000</pubDate>
    <author>Root-Me PRO</author>
    <guid>https://blog.root-me.org/posts/writeup_dgse/</guid>
    <description><![CDATA[Solution of the recruitment CTF of Direction Générale de la Sécurité Extérieur (DGSE) during April 2025]]></description>
</item>
<item>
    <title>Writeup - ComCyber - Marine Nationale Recrutement CTF</title>
    <link>https://blog.root-me.org/posts/writeup_comcyber_marine/</link>
    <pubDate>Mon, 31 Mar 2025 00:00:00 &#43;0000</pubDate>
    <author>Nishacid</author>
    <guid>https://blog.root-me.org/posts/writeup_comcyber_marine/</guid>
    <description><![CDATA[Solution of the recruitment CTF of ComCyber Marine Nationale during March 2025]]></description>
</item>
<item>
    <title>Code Snippet Serie - 05 - Integer Overflow &amp; Stack Overflow</title>
    <link>https://blog.root-me.org/posts/writeup_snippet_05/</link>
    <pubDate>Mon, 03 Feb 2025 00:00:00 &#43;0000</pubDate>
    <author>baguette</author>
    <guid>https://blog.root-me.org/posts/writeup_snippet_05/</guid>
    <description><![CDATA[Challenge Description This challenge, authored by @baguette, involves exploiting an integer overflow vulnerability combined with a stack overflow, allowing arbitrary writes to the stack.
Vulnerability Overview 🛑 Vulnerability: The vulnerability lies in the improper handling of integer values and the use of the read function, which allows writing arbitrary data to the stack.
Exploitation Process 1. Triggering the Integer Overflow: When len is set to -2147483648 (minimum value of a signed 32-bit integer), the call to abs(len) results in an overflow.]]></description>
</item>
<item>
    <title>Code Snippet Serie - 04 - SSRF and HTTP Hop-by-Hop Header Injection</title>
    <link>https://blog.root-me.org/posts/writeup_snippet_04/</link>
    <pubDate>Fri, 03 Jan 2025 00:00:00 &#43;0000</pubDate>
    <author>baguette</author>
    <guid>https://blog.root-me.org/posts/writeup_snippet_04/</guid>
    <description><![CDATA[Challenge Description This challenge, authored by @baguette, involves exploiting vulnerabilities in a Flask application that acts as a proxy. The application is behind a cache server managed by a varnish and a load balancer managed by a nginx. The application has two main routes: / and /admin. The / route proxies requests to https://root-me.org, while the /admin route restricts access based on the presence of the X-Real-IP header.
Vulnerability Overview 🛑 Vulnerabilities: The application is vulnerable to Server-Side Request Forgery (SSRF) and HTTP Hop-by-Hop Header Injection.]]></description>
</item>
<item>
    <title>Code Snippet Serie - 03 - Cross-Function-Reentrancy</title>
    <link>https://blog.root-me.org/posts/writeup_snippet_03/</link>
    <pubDate>Tue, 03 Dec 2024 00:00:00 &#43;0000</pubDate>
    <author>K.L.M</author>
    <guid>https://blog.root-me.org/posts/writeup_snippet_03/</guid>
    <description><![CDATA[Challenge Description This challenge, authored by @KLM, involves exploiting a vulnerability in a vyper smart contract that utilize a Cross-Function-Reentrancy due to a problem in the vyper version. This smart contract is made for a company to sell shares on the blockchain to help and ensure everything is secure, tracked and transparent.
Vulnerability Overview 🛑 Vulnerability: The vulnerability lies in the insecure version of Vyper that desynchronise the values of the @nonreentrant(&quot;lock&quot;) between function in a contract and the bad execution flow management.]]></description>
</item>
<item>
    <title>Code Snippet Serie - 02 - Memory Exhaustion via Unchecked Input Length</title>
    <link>https://blog.root-me.org/posts/writeup_snippet_02/</link>
    <pubDate>Tue, 05 Nov 2024 00:00:00 &#43;0000</pubDate>
    <author>Ethnical</author>
    <guid>https://blog.root-me.org/posts/writeup_snippet_02/</guid>
    <description><![CDATA[Challenge Description This challenge, authored by @Ethnical and @fadam, involves exploiting a vulnerability in a blockchain network server that processes incoming network messages. The vulnerability allows an attacker to cause a Denial of Service (DoS) by exhausting the server&rsquo;s memory.
Vulnerability Overview 🛑 Vulnerability: The vulnerability lies in the unchecked allocation of memory based on user-controlled input length, leading to potential memory exhaustion.
Technical Analysis Vulnerability Details Unchecked Length Parameter:]]></description>
</item>
<item>
    <title>Code Snippet Serie - 01 - SQL Like injection</title>
    <link>https://blog.root-me.org/posts/writeup_snippet_01/</link>
    <pubDate>Fri, 04 Oct 2024 00:00:00 &#43;0000</pubDate>
    <author>Elweth</author>
    <guid>https://blog.root-me.org/posts/writeup_snippet_01/</guid>
    <description><![CDATA[Challenge Description This challenge, authored by @Elweth, involves exploiting a vulnerability in a SQL Query which lets you abuse the LIKE clause to first bypass authentication and then retrieve the entire API key.
Vulnerability Overview 🛑 Vulnerability: The vulnerability lies in the SQL query, which remains vulnerable despite the use of the prepare statement system in Python.
Conventional SQL injection exploitation methods won&rsquo;t work here, because the query is correctly prepared with python.]]></description>
</item>
<item>
    <title>Writeup - ComCyber Recrutement CTF</title>
    <link>https://blog.root-me.org/posts/writeup_comcyber/</link>
    <pubDate>Mon, 30 Sep 2024 00:00:00 &#43;0000</pubDate>
    <author>Nishacid</author>
    <guid>https://blog.root-me.org/posts/writeup_comcyber/</guid>
    <description><![CDATA[Solution of the recruitment CTF of ComCyber during September 2024]]></description>
</item>
<item>
    <title>10 commandments of writing solution</title>
    <link>https://blog.root-me.org/posts/10_commandments_solution/</link>
    <pubDate>Sun, 01 Sep 2024 00:00:00 &#43;0000</pubDate>
    <author>Nishacid</author>
    <guid>https://blog.root-me.org/posts/10_commandments_solution/</guid>
    <description><![CDATA[Ever wanted to write (good) solution on Root-Me ? You are in the right place]]></description>
</item>
<item>
    <title>Interview of Gregory Gille - CEO of GEOIDE</title>
    <link>https://blog.root-me.org/posts/interview_gregory_gille/</link>
    <pubDate>Fri, 19 Jan 2024 00:00:00 &#43;0000</pubDate>
    <author>Gregory Gille</author>
    <guid>https://blog.root-me.org/posts/interview_gregory_gille/</guid>
    <description><![CDATA[Gregory Gille @1-vek, co-founder of Hyvilo and CEO of GEOIDE, Sponsor Specialist of Root-Me. Find out more about his career and his story with Root-Me!]]></description>
</item>
</channel>
</rss>