I solved 6 flags across two Hacker101 CTFs (RTFM and Hackyholidays) in one session. Each flag taught me a technique that maps directly to real bug bounty hunting. This is the reference I wish I had before I started.
1. Config Endpoint Exposure
Always check /config, /status, /health, /debug, /env on every API. RTFM had a private key sitting in /api/v1/config. In real bug bounties, I have seen Swagger UI and OpenAPI specs exposed the same way. Most hunters skip these because they seem too simple. That is exactly why they pay.
2. Content-Type Matters
RTFM rejected JSON but accepted form-encoded data. I spent 20 minutes sending the wrong format. Always test both application/json AND application/x-www-form-urlencoded. APIs can silently reject one format while processing the other.
3. SSRF via Image URL Fields
Any field that accepts a URL and the server fetches it is an SSRF vector. RTFM had an avatar field that fetched the URL and returned the response body in an error message. Point it to http://127.0.0.1/ and you can read internal services. Bypass IP filters with hex (0x7f000001), decimal (2130706433), or octal (0177.0.0.1) representations.
4. IDOR via Obfuscated IDs
Hackyholidays People Rater used base64-encoded JSON IDs. Decoding eyJpZCI6Mn0= gives {"id":2}. The list started at id=2, but id=1 was hidden and contained the flag. Always decode IDs, always try id=0 and id=1 when the visible list starts higher. Encoding is not security.
5. Session Leak to Account Hijacking Chain
The swag shop had /api/sessions that listed ALL active sessions including authenticated user UUIDs. I extracted the UUID and passed it to /api/user?uuid=UUID to get the user data and flag. Two requests: session leak then IDOR. This pattern pays real money because the chain demonstrates full impact.
6. Hidden Data in HTML Attributes
The secret area page had a flag hidden in a data-info attribute and the real page path in a next-page attribute. View Source is not enough — you need to inspect data-* attributes, hidden inputs, JavaScript variables, and CSS-hidden elements. Use DevTools Elements tab and search for keywords.
7. Boolean Blind SQL Injection
The evil quiz stored the player name in a database then queried it with COUNT. Injecting OR 1=1 changed the count from 1 to 18 — confirming MySQL injection. Boolean blind SQLi uses TRUE/FALSE responses to extract data one bit at a time. Slow but devastating. The admin table was right there waiting to be dumped.
8. Never Skip robots.txt
The very first flag was in robots.txt — along with a hidden directory path. Also check sitemap.xml, .well-known/security.txt, and humans.txt. The basics pay because most hunters skip them.
9. API Version Enumeration
RTFM had both /api/v1/ (X-Token auth) and /api/v2/ (X-Session auth) with different authentication mechanisms. Always check /api/v1/, /api/v2/, /api/v3/, /api/beta/, /api/internal/. Older versions often have weaker security.
10. Source Code in Downloadable Archives
The signup manager had signupmanager.zip downloadable with full PHP source code, including the README.md that revealed default credentials, file-based user storage, and the admin flag mechanism. Check for .zip, .tar.gz, .bak, .git/ on every target.
CTFs are not practice for bug bounties. They ARE bug bounties — with faster feedback loops and no triage waiting. Every technique transfers.
— Seetha
No comments yet