Magic Bytes

Web challenge exploiting a ZIP-based asset upload through magic-byte forgery and a Zip Slip path traversal to plant a malicious Gunicorn hook.

Linux machine bypassing a SQL injection login, forging magic bytes to upload a PHP webshell, and hijacking a SUID binary’s relative-path lshw call for root.

Linux machine bypassing MIME-based upload filters with forged magic bytes, exploiting an unsanitised filename in a cron job, then a network config script’s variable-parsing quirk for root.