codeasm
Cyber stuff
Recent writeups
all →MalwareHuntress CTF 2026
Bridge Troll
The same `HCFG` config format from Nimble, but cranked up to **22 language runtimes / 264 answer fields**.
WebHuntress CTF 2026
Django Dispatch
A tiny Django app with one authz boundary.
WebHuntress CTF 2026
Double Spent
A two-route app: `POST /execute-bdb3f6` spends one credit (read balance → check `> 0` → decrement, and that's **not atomic**), and `GET /audit-ad790f` hands over the flag once the balance goes negative.
WebHuntress CTF 2026
Error Courtesy
An ASP.NET Core app whose own clue states the intended behavior: *"deny access when the policy service is unavailable."* The bug is that it does the opposite.