Selected Writeups from NISC CTF 2019
0x00 Game. Inspecting the source reveals a suspicious JavaScript file. Sending a POST request with score=15 returns the data. 0x01 Who are you? The source suggests XML injection, and testing confirms an XXE vulnerability. Because the flag path is unknown, use php://filter…