Ghost Zero

d3c2026

Task: A search box tunnels queries through an ECDH+AES-GCM gateway to a UNION-injectable SQLite backend. Solution: SQLi + sqlite_dbpage carving recovers a deleted record pointing to a pcap; the pcap's legacy /ddddddtestStat route is requested as a gateway target to mint a fresh ticket, and /api/auth/exchange upgrades the session-scoped ticket to an admin JWT for /api/flag.