Reversing a custom key exchange and stream cipher to get on the wire, then a refcounted free that leaves a live pointer, ending in House of Apple on _IO_2_1_stdout_
A transfer that frees a ledger and then copies the dangling pointer into the destination, turned into tcache poisoning, a forged wallet struct and a GOT overwrite
Overflowing a bot browser cookie jar to evict an HttpOnly role cookie that JavaScript could not overwrite, then writing the privileged value in its place
Reaching an internal wkhtmltopdf service through a commented-out SSRF form, upgrading the GET-only fetch to a POST with gopher://, and reading /flag.txt out of the rendered PDF
An off-by-one that lands the frame CRC byte on a capacity field, stretching the dump command until it spills the canary and a PIE pointer
A textbook printf(buf) with eight tries, leaking PIE and libc off the stack then overwriting printf@got with system in a single format call
A hand-rolled printf with an undocumented %w specifier that writes one vararg to the address in another, turned into a GOT overwrite on strcspn
A one-bit Postgres oracle with stacked queries, an input lowercaser that silently folds payload literals, and a pg_read_file grant that pg_has_role denies
A flag scattered into dead stack as thirteen chunks, read back four bytes at a time through an uninitialised int that a failed parse never writes
A ROP chain limited to three bytes per call, used to speak to a seccomped child process over its socketpair and hand it a negative vault index
Pointing a screenshot drone at its own admin session through an IPv6 loopback the blocklist missed, then using a URL fragment to scroll the flag into the viewport
