Writeups

Stats

5

Writeups

The Redirect Any App Could Catch leading to ATO

From a decompiled APK to minting my own OAuth tokens, and the custom scheme that let any app on the phone catch them to Account Takeover.

When a Send Button Becomes a Trusted Mail Relay

A business-logic bug that turned a fresh account with no company context into a fully functional phishing relay using the platform's own mail infrastructure.

A Host Token That Talked To Strangers

Out of the box bug hunting.

Thank You Javascript - Plfanzen 2026 CTF Writeup

Using multiple unique JS techniques to get to the flag.

Breaking SameSite=Strict in chrome

How we bypassed SameSite=Strict protections using service worker, unintentionally