ECHO · Public
Live Blog
The running log. Essays, write-ups and field notes from ECHO members — public, citable, and open to anyone, not just the club.
What’s next
The next write-up starts as a countdown
Every report below began as an event on the club calendar. Here is what is on it now — and where an organiser has published a date but not a start hour, the clock says days and says why, rather than inventing an hour to fill itself with. Pick any entry underneath to step the readout onto it.
Posts
Latest first
Featured solve
This month’s standout
Write-ups
Competition and certification write-ups
How a solve actually went — the approach, the method, the findings, and the lesson that outlives the flag. Written after the event and published as-is, because a write-up that has been tidied into a success story teaches nobody anything.
Technique · sanitized
Enumerate to Escalate: A Two-Stage Web Chain
Two findings that look minor apart and are a full authorization bypass together: an
unauthenticated directory read that leaks every account’s role string, and an
admin route that treats that same string as a shared secret. The endpoint that leaks the
roles is the one that unlocks the endpoint that checks them — and the note it hands
back carries plaintext credentials for an internal shell, where a single
NOPASSWD sudo rule on an ordinary mail binary becomes root.
boroCTF 2026 · report
41 Solves, Six Categories, One Competitor
ECHOClub’s full competition report, published in full: every solve with its category, points and timestamp, plus the hard ones worked end to end — JWT forging through the alg:none hole, carving a 10 TB sparse file down to its eight real regions, reading binary out of packet timing, and undeleting a zip from an NTFS disk image that mounted clean. PDF download on the page.
ACE-T Core · Volume I
Forensics & Malware Analysis
ACE-T Core is not a multiple-choice badge — section three of the exam is
report writing. Volume I is four Antisyphon Cyber Range challenges worked end to
end: a DLL search-order hijack found in 108,560 Procmon events, an FTP file
rebuilt out of a raw packet stream, a 0x2a injection mask hunted through a
Sysmon log, and a malicious DLL pulled from a 143 MB minidump.
ACE-T Core · Volume II
Network Recon & Forensics
The second submitted report: enumerating a full SNMP MIB through a factory-default
public community string, attributing a suspect IP, breaking a
bcrypt hash whose cost factor was set to 4, and reversing a PNG that had been
turned into 1,910 lines of xxd output. Each one carries its threat
assessment and its recommendations, not just the flag.
BrunnerCTF 2026 · Three solves
Three Solves from BrunnerCTF 2026
Three challenges worked end to end: a username-less 2FA account takeover, a CL.TE HTTP request-smuggling chain, and an LLM-driven chess puzzle. Method, reasoning, and the flag for each.
Technique
Browser Cookie Value Manipulation
How a client-side cookie value becomes an attack surface when the server trusts it, how to spot it, and the defensive fix — a lab-safe walk-through of the technique and why signed, server-side state ends it.