> For the complete documentation index, see [llms.txt](https://ctf.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.zeyu2001.com/2023/def-con-ctf-2023-qualifiers.md).

# DEF CON CTF 2023 Qualifiers

Won this CTF with Blue Water, the collaboration between Water Paddler and Perfect Blue!

<figure><img src="https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2FpIkORXbEup1igYWeMs17%2Fimage.png?alt=media&amp;token=a82cc7a6-4e10-410f-ae70-813528bbf169" alt=""><figcaption></figcaption></figure>

I made slides on the two web challenges I worked on:

* **Artifact Bunker**, which involves leaking data from a tar archive using partial zip file overwrites.
* **Brinebid**, which involves reversing a JavaScript implementation of Python's Pickle serialization to gain remote code execution.

{% embed url="<https://www.zeyu2001.com/pdf/talks/sgco/DEFCON23.pdf>" %}