CTF Blogs on Anshik Singhhttps://anshik.in/blogs/ctf/Recent content in CTF Blogs on Anshik SinghHugoen-usWed, 07 Oct 2026 12:00:00 +0530How I Completed the FAM CTF Secret-Finder Bounty — From APK Strings to Cloud SSRFhttps://anshik.in/blogs/ctf/fam-ctf-secret-finder/Wed, 07 Oct 2026 12:00:00 +0530https://anshik.in/blogs/ctf/fam-ctf-secret-finder/This is how I solved the FAM CTF secret-finder bounty end to end — an Android APK (fam.apk, package com.ctf.fam) plus its backends: a Firebase project (fam-ctf), a web portal at ctf.fampay.co/famctf, and a public EC2 “NexOps” monitoring instance. Total haul: 950+ pts across static (APK reversing) and dynamic (Firebase, web, cloud/AWS) tracks. Tools I used: apktool (via a patched secret_finder.py), apkleaks (docker), strings / objdump / readelf for native reversing, curl for all HTTP/REST work, and boto3 for AWS SigV4 signing.