Authorized CTF Documentation
Writeups & CTF Reports
Authentic vulnerability walkthroughs, root-cause analyses, and OSINT investigations from V3CT0R CTF 2026. Documented under authorized challenge rules of engagement with defensive remediation and reproducible attack chains.
Category:
Showing 3 of 3 publications
Web SecurityV3CT0R CTF 2026
7 min read
Meridian Technologies — Password Reset Vulnerability
Administrative account takeover via predictable Base64-encoded password recovery tokens combined with user enumeration on the forgot-password endpoint.
Web SecurityCTFV3CT0R 2026CWE-640CWE-204Account TakeoverToken Prediction
Web SecurityV3CT0R CTF 2026
8 min read
Meridian Market — IDOR / BOLA
Insecure Direct Object Reference (IDOR / BOLA) assessment in the Meridian Market order portal, exploiting missing object-level authorization checks on customer order records.
Web SecurityCTFV3CT0R 2026IDORBOLACWE-639API SecurityAccess Control
OSINTV3CT0R CTF 2026
9 min read
The Anonymous Playlist — OSINT Challenge
Multi-stage OSINT investigation involving cross-platform digital footprinting, shortened URL redirect analysis, public Spotify asset extraction, and automated QR code matrix reconstruction.
OSINTCTFV3CT0R 2026Digital FootprintingQR ReconstructionURL AnalysisSpotify