🇬🇧 FCSC 2026 - 10 Fast Fishers

Sun, 12 Apr 2026 00:00:00 +0000

Introduction
TLDR
Infrastructure Analysis
Hijacking the Trusted iframe
- The weak e.source check
- Navigating the inner frame to about:blank
10 Fast Fishers, 1 Weird Fish
Gone Fishing
Conclusion

Introduction

10 Fast Fishers is a 1-star web challenge from FCSC 2026. The application is a typing game: fish swim across an aquarium, each carrying a word and a text formatting command.

You type a word, click the fish and the corresponding document.execCommand() is applied to the selected text in a contenteditable editor.

Introduction

Secure Mood Notes is a two-part web challenge from FCSC 2026. Both parts share the same infrastructure: a note-taking application where notes have “moods” (angry, chill, normal) that transforms their content. The first flag is hidden inside the Snuffleupagus configuration, and the second one requires full remote code execution on the server.

FCSC 2026 Writeups on conflict

🇬🇧 FCSC 2026 - 10 Fast Fishers

Table of Contents

Introduction

🇬🇧 FCSC 2026 - Secure Mood Notes

Table of Contents

Introduction