Cybersecurity research notes and CTF write-ups by Kyruxhttps://kyrux.xyz/https://kyrux.xyz/ctf/ctf-cit-2026/web-a-massive-problem/https://kyrux.xyz/ctf/ctf-cit-2026/web-a-massive-problem/CTF@CIT 2026Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/ctf-cit-2026/web-debug-disaster/https://kyrux.xyz/ctf/ctf-cit-2026/web-debug-disaster/CTF@CIT 2026Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/ctf-cit-2026/web-intern-portal/https://kyrux.xyz/ctf/ctf-cit-2026/web-intern-portal/CTF@CIT 2026Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/hackthebox/web-artificialuniversity/https://kyrux.xyz/ctf/hackthebox/web-artificialuniversity/HackTheBoxThu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/hackthebox/web-batchcraft-potions/https://kyrux.xyz/ctf/hackthebox/web-batchcraft-potions/HackTheBoxThu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/hackthebox/web-c-o-p/https://kyrux.xyz/ctf/hackthebox/web-c-o-p/HackTheBoxThu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/hackthebox/web-dusty-alleys/https://kyrux.xyz/ctf/hackthebox/web-dusty-alleys/HackTheBoxThu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/hackthebox/web-nextpath/https://kyrux.xyz/ctf/hackthebox/web-nextpath/HackTheBoxThu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/hackthebox/web-resizer/https://kyrux.xyz/ctf/hackthebox/web-resizer/HackTheBoxThu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/hackthebox/web-spookifier/https://kyrux.xyz/ctf/hackthebox/web-spookifier/HackTheBoxThu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/hackthebox/web-torandoservice/https://kyrux.xyz/ctf/hackthebox/web-torandoservice/HackTheBoxThu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/tamuctf-2026/web-bad-apple/https://kyrux.xyz/ctf/tamuctf-2026/web-bad-apple/TAMUCTFThu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/tamuctf-2026/web-broken-website/https://kyrux.xyz/ctf/tamuctf-2026/web-broken-website/TAMUCTFThu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/umassctf-2026/web-brick-by-brick/https://kyrux.xyz/ctf/umassctf-2026/web-brick-by-brick/UMassCTF 2026Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/umassctf-2026/web-browser-boss-fight/https://kyrux.xyz/ctf/umassctf-2026/web-browser-boss-fight/UMassCTF 2026Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/umassctf-2026/web-the-block-city-times/https://kyrux.xyz/ctf/umassctf-2026/web-the-block-city-times/UMassCTF 2026Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/umassctf-2026/web-turncoat-s-treasure/https://kyrux.xyz/ctf/umassctf-2026/web-turncoat-s-treasure/UMassCTF 2026Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/0-1-dns-basic/https://kyrux.xyz/blog/0-1-dns-basic/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/02-http-basics/https://kyrux.xyz/blog/02-http-basics/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/03-html-and-js-for-pentesters/https://kyrux.xyz/blog/03-html-and-js-for-pentesters/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/11-basic-command/https://kyrux.xyz/blog/11-basic-command/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/21-sql-injection/https://kyrux.xyz/blog/21-sql-injection/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/22-os-command-injection/https://kyrux.xyz/blog/22-os-command-injection/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/31-access-control-vulnerabilities-and-privilege-escalation/https://kyrux.xyz/blog/31-access-control-vulnerabilities-and-privilege-escalation/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/32-insecure-direct-object-references-idor/https://kyrux.xyz/blog/32-insecure-direct-object-references-idor/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/41-authentication-vulnerabilities/https://kyrux.xyz/blog/41-authentication-vulnerabilities/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/51-cross-site-scripting-xss/https://kyrux.xyz/blog/51-cross-site-scripting-xss/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/52-reflected-xss/https://kyrux.xyz/blog/52-reflected-xss/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/53-stored-xss/https://kyrux.xyz/blog/53-stored-xss/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/55-dom-based-xss/https://kyrux.xyz/blog/55-dom-based-xss/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/61-path-traversal/https://kyrux.xyz/blog/61-path-traversal/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/62-file-upload/https://kyrux.xyz/blog/62-file-upload/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/71-race-condition/https://kyrux.xyz/blog/71-race-condition/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/81-insecure-deserialization/https://kyrux.xyz/blog/81-insecure-deserialization/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/82-cach-khai-thac-lo-hong/https://kyrux.xyz/blog/82-cach-khai-thac-lo-hong/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/bypass-gioi-han-ky-tu-trong-cmdi/https://kyrux.xyz/blog/bypass-gioi-han-ky-tu-trong-cmdi/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/cheatsheet-cmdi/https://kyrux.xyz/blog/cheatsheet-cmdi/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/cheatsheet-for-sqli/https://kyrux.xyz/blog/cheatsheet-for-sqli/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/cheatsheet-for-xss/https://kyrux.xyz/blog/cheatsheet-for-xss/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/note/https://kyrux.xyz/blog/note/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/special/https://kyrux.xyz/blog/special/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/blog/sqli-quine/https://kyrux.xyz/blog/sqli-quine/Thu, 14 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/bksec-training-2026/web-cutie-web-framework/https://kyrux.xyz/ctf/bksec-training-2026/web-cutie-web-framework/BKSEC_trainingWed, 13 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/bksec-training-2026/web-gambling-coin-1/https://kyrux.xyz/ctf/bksec-training-2026/web-gambling-coin-1/BKSEC_trainingWed, 13 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/bksec-training-2026/web-gambling-coin-2/https://kyrux.xyz/ctf/bksec-training-2026/web-gambling-coin-2/BKSEC_trainingWed, 13 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/bksec-training-2026/web-gambling-coin-3/https://kyrux.xyz/ctf/bksec-training-2026/web-gambling-coin-3/BKSEC_trainingWed, 13 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/bksec-training-2026/web-happy-soldier/https://kyrux.xyz/ctf/bksec-training-2026/web-happy-soldier/BKSEC_trainingWed, 13 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/bksec-training-2026/web-happy-soldier-revenge/https://kyrux.xyz/ctf/bksec-training-2026/web-happy-soldier-revenge/BKSEC_trainingWed, 13 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/bksec-training-2026/web-low-effort-sns/https://kyrux.xyz/ctf/bksec-training-2026/web-low-effort-sns/BKSEC_trainingWed, 13 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/bksec-training-2026/web-maze-maze-mazeee/https://kyrux.xyz/ctf/bksec-training-2026/web-maze-maze-mazeee/BKSEC_trainingWed, 13 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/bksec-training-2026/web-parrot/https://kyrux.xyz/ctf/bksec-training-2026/web-parrot/BKSEC_trainingWed, 13 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/bksec-training-2026/web-report-the-violations/https://kyrux.xyz/ctf/bksec-training-2026/web-report-the-violations/BKSEC_trainingWed, 13 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/bksec-training-2026/web-time-traveler/https://kyrux.xyz/ctf/bksec-training-2026/web-time-traveler/BKSEC_trainingWed, 13 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/sejong-hacktheon-2026/web-observatory/https://kyrux.xyz/ctf/sejong-hacktheon-2026/web-observatory/Sejong Hacktheon 2026Wed, 13 May 2026 00:00:00 GMThttps://kyrux.xyz/ctf/sejong-hacktheon-2026/web-simple-sqli/https://kyrux.xyz/ctf/sejong-hacktheon-2026/web-simple-sqli/Sejong Hacktheon 2026Wed, 13 May 2026 00:00:00 GMT