Insomni'hack teaser 2022

Git repo secret.

Prototype pollution which allows to run arbitrary js in admin context and retrieve the flag through the sql injection with an error based injection.

A rooted Android phone could be handy sometimes.

Leak data via LED lights.

Hermes Bytecode Reverse Engineering.

I really hate to guess paths.

Host header, XXE, JWT, and serialization.