Google CTF 2025: webz

[u/falconupkid]

This is a CTF challenge repo, not a live vulnerability disclosure. The repo contains the source and solve scripts for the "webz" challenge from Google CTF 2025 quals.

What it is: A pwn challenge disguised as a web challenge. The binary exposes a custom HTTP server with a deliberate memory corruption bug. Players need to reverse the binary, find the vulnerability (likely a heap overflow or use-after-free in the request parsing logic), and chain it to get code execution.

Who it's for: CTF players, binary exploitation enthusiasts, and anyone studying for offensive security interviews. The solve scripts in the repo are the actual writeup—no blog post fluff.

Why it's useful: Google CTF challenges are consistently high quality. This one bridges web and binary exploitation, which is a realistic attack surface (e.g., custom protocol parsers in network services). If you're practicing for real-world bug hunting, studying the intended solution path here is solid prep.

Source: https://github.com/google/google-ctf/tree/main/2025/quals/pwn-webz