SASCTF 2025 Quals

XSS in a BBCode image parser lets attackers steal the bot JWT and read its private post.

Crafting a specific 8-byte input to pass a custom validation function.

The challenge exploits a type confusion between integers and pointers to gain arbitrary write.

Exploited a misconfigured Caddy reverse proxy via SSRF.