Preliminary research

SECCON CTF 14 Finals: Shadow CSS and friends

SECCON CTF 14 Finals: Author Writeups

arkark · arkark · 8 March 2026

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Explains SECCON web challenges including a Firefox Link-header stylesheet load that combines response truncation and integrity checks into a secret-prefix oracle. Other solutions examine chunk-boundary UTF-8 loss, HTML reserialization and cookie parsing; the Shadow CSS leak comes from response bytes rather than selectors penetrating a closed shadow tree.

Record

Document

SECCON CTF 14 Finals: Author Writeups

Researcher

arkark

Published by

arkark

Date

8 March 2026

Topic

Other

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• SECCON CTF 14 challenge source and solvers
• Shadow DOM CSS leakage background Slides

Tags

• css
• info-leak
• header-injection
• side-channel
• encoding
• parser-differential
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of arkark, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.