root@z2r:~/blog/tags#grep -r "webverse" ./posts
<Tag: webverse />
Found 1 post with this tag.
CTF WRITEUPSWEB
WebVerse Pro | Challenge - VelvetRope
I found that Gilt & Grain's Members Portal authenticated against an unescaped LDAP filter, letting me bypass login entirely with a wildcard payload that matched any directory entry instead of verifying real credentials. The bug came down to the app treating "a matching record was found" as proof of a correct password, rather than performing an actual LDAP bind to check it.