Preliminary research

SECCON CTF 14 Finals: Shadow CSS and friends

arkark · arkark · 8 March 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Explains SECCON web challenges including a Firefox Link-header stylesheet load that combines response truncation and integrity checks into a secret-prefix oracle. Other solutions examine chunk-boundary UTF-8 loss, HTML reserialization and cookie parsing; the Shadow CSS leak comes from response bytes rather than selectors penetrating a closed shadow tree.

Record

Researcher

arkark

Published by

arkark

Date

8 March 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• SECCON CTF 14 challenge source and solvers
• Shadow DOM CSS leakage background

Tags

• css
• info-leak
• header-injection
• side-channel
• encoding
• parser-differential
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of arkark, first published at the original source. Preserved copies are kept so the citation survives its host.