visitor@innoctf:~$ cat mission.txt
Independent security learning resourceInnoCTF publishes practitioner-grade capture-the-flag writeups and structured training across web, binary exploitation, cryptography, forensics, and reversing. Reproducible methods, cited sources, no hand-waving.
Microsoft shows how a few lines of hidden text in an MCP tool description make an AI agent quietly exfiltrate data while every step stays policy-compliant. The bug class, the chain, and the defenses.
Russian intelligence fake support texts steal a Signal Backup Recovery Key, turning one slip into persistent account access. The bug class, the chain, and the defenses.
CVE-2025-67038 concatenates an unauthenticated username into a root shell command on a failed login. The bug class, the chain, and how to defend it.
A lookalike of postcss-selector-parser decrypts a dropper, writes a PowerShell stager, and lands a Windows RAT. The bug class, the chain, and the defenses.
A poisoned build pipeline shipped backdoored WordPress Pro plugins through the official update channel. The bug class, the implant, and how to detect it.
AutoJack steers a browsing agent into a loopback daemon that spawns a process. The root cause is a service that trusts any local caller. Lab repro inside.
From confirming an injectable parameter to UNION and blind extraction, then working past the filters authors love to add.
Reusing the binary's own code, gadget by gadget, to call execve when the stack is non-executable. Full reproduction.
Triage a memory image with Volatility 3, flag a private RWX region, and carve the injected implant for analysis.
AutoJack, FortiBleed, and SocGholish read together: the layer you trust to protect a system is now the way in.