Hey — I'm Shubham Bhat, a security enthusiast and CTF player. This repository is a collection of my writeups from various Capture The Flag competitions, covering web exploitation, mobile security, cloud infrastructure, reverse engineering, and more.
Each writeup documents the full approach — reconnaissance, exploitation, wrong turns, and key takeaways. These also appear as articles on my Medium.
| Event / Challenge | Category | Tags | Medium Post | Writeup |
|---|---|---|---|---|
| FamPay CTF 2026 — The Native String |   |
strings, JNI, native-lib |
📝 Read | 📄 Writeup |
| FamPay CTF 2026 — Firebase Anon Auth |  |
Firebase, RTDB, anonymous-auth |
📝 Read | 📄 Writeup |
| FamPay CTF 2026 — App Check Bypass |  |
Firebase, App-Check, debug-token |
📝 Read | 📄 Writeup |
| FamPay CTF 2026 — Signature Bypass |  |
SHA-256, FNV-1a, Ghidra, JNI |
📝 Read | 📄 Writeup |
| FamPay CTF 2026 — JWT alg:none | |
JWT, alg-none, cookie-tampering |
📝 Read | 📄 Writeup |
| FamPay CTF 2026 — SSRF → IMDS → S3 |  |
SSRF, IMDSv2, AWS, S3, SigV4 |
📝 Read | 📄 Writeup |
| CloudSEK CTF 2026 — Internal Affairs 1 (LFI) | |
LFI, vhost, php-filter, nginx |
📝 Read | 📄 Writeup |
| CloudSEK CTF 2026 — Echoes of Runtime |  |
heapdump, Spring-Boot, XOR, PAT |
📝 Read | 📄 Writeup |
| CloudSEK CTF 2026 — Internal Affairs 2 (RCE) | |
Phar-deser, RCE, SQLite, open_basedir |
📝 Read | 📄 Writeup |
ctf-writeups/
├── README.md
├── LICENSE
├── .gitignore
└── 2026/
├── fampay-ctf/
│ ├── fampay-ctf-2026.md
│ └── assets/
└── cloudsek-ctf/
├── cloudsek-ctf-2026.md
└── assets/
A non-exhaustive list of tools and techniques referenced across writeups:
| Tool / Technique | Used In |
|---|---|
strings, objdump, Ghidra |
FamPay — Native reversing |
| Firebase Identity Toolkit | FamPay — Anonymous auth |
| Firebase App Check Debug Token | FamPay — App Check bypass |
JWT alg:none forgery |
FamPay — NexaVault |
| SSRF via hostname bypass (IMDSv2) | FamPay — NexOps Cloud |
| AWS SigV4 pre-signed URLs | FamPay — S3 exfiltration |
ffuf (vhost fuzzing) |
CloudSEK — Internal Affairs 1 |
PHP php://filter stream wrappers |
CloudSEK — LFI + source read |
Spring Boot Actuator /heapdump |
CloudSEK — Echoes of Runtime |
| XOR decryption of obfuscated PAT | CloudSEK — Echoes of Runtime |
| Phar deserialization (gadget chain) | CloudSEK — Internal Affairs 2 |
john (MD5 cracking) |
CloudSEK — Internal Affairs 2 |
This project is licensed under the MIT License.
If you found these writeups helpful, consider giving this repo a ⭐