Preliminary research

SECCON CTF 14 Finals: Shadow CSS and friends

arkark · arkark · 8 March 2026

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Explains SECCON web challenges including a Firefox Link-header stylesheet load that combines response truncation and integrity checks into a secret-prefix oracle. Other solutions examine chunk-boundary UTF-8 loss, HTML reserialization and cookie parsing; the Shadow CSS leak comes from response bytes rather than selectors penetrating a closed shadow tree.

Record

Researcher

arkark

Published by

arkark

Date

8 March 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• SECCON CTF 14 challenge source and solvers
• Shadow DOM CSS leakage background

Tags

• css
• info-leak
• header-injection
• side-channel
• encoding
• parser-differential
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of arkark, first published at the original source. Preserved copies are kept so the citation survives its host.