6 min read
squ1rrel CTF 2026 — rails Writeup
Three small Rails mistakes chain together: an attacker-controlled constantize leaks the JWT signing secret, the admin middleware accepts any HS256 token signed with it, and an array query parameter defeats the reserved-post check to return the flag.
#CTF#Cybersecurity#Web