intigriti Challenge 0326

Description

Come play our monthly CTF!

Bounties

This is a responsible disclosure program without bounties.

Rules of Engagement

• @intigriti.me: Not applicable
• User agent: Not applicable
• Automated tooling: Not applicable
• Request header: Not applicable

Safe harbour for researchers is applied. See https://go.intigriti.com/researcher-rules-of-engagement

Assets

Rules

This challenge runs from 16/03/2026 12:00 PM until 23/03/2026, 11:59 PM UTC.

Out of all correct submissions, we will draw seven winners on Wednesday 25/02/2026:

• First blood
• Three randomly drawn correct submissions
• Three best write-ups

Every winner gets a €50 swag voucher for our https://www.swag.intigriti.com swag shop.

First blood receives a €100 swag voucher!

The winners will be announced on our https://x.com/intigriti X profile.

For every 100 likes, we'll add a tip to announcement post.

Join https://go.intigriti.com/discord our Discord to discuss the challenge!

The Solution

• Should leverage a XSS vulnerability on the challenge page
• Shouldn't be self-XSS or related to MiTM attacks
• Should work in the latest version of Google Chrome
• Should include:
  • The flag in the format INTIGRITI{.*}
  • The payload(s) used
  • Steps to solve (short description / bullet points)
• Should be reported on the Intigriti platform

Get Started

Test your payloads on the https://challenge-0326.intigriti.io/challenge.html challenge page & let's capture that flag!

Out of Scope

N/A

Severity Assessment

This program follows Intigriti's https://go.intigriti.com/triage-standards triage standards based on the proof of concept.