This year I had the privilege of competing in the European Cybersecurity Challenge on the Australian guest team. I got to travel to Poland, meet some legendary CTF players, and enjoy some quality CTF challenges (especially during the Attack/Defense CTF).
The challenge I spent most of my time on during the Attack/Defense CTF was called "Firewall". It was a pretty large application with a lot of interesting functionality, including its own VPN, an FTP service, and a web interface that enabled SNMP interactions. Almost all my work on this challenge focused on the SNMP interactions, but I didn't manage to find the primary bug in it myself. Instead, a teammate and I worked on replicating an exploit that another team was attacking us with.
Long story short, the bug was difficult for us to replicate based on the traffic we had, and by the time we figured it out, it was far too late in the competition to do anything with it. I'm not going to go into detail on the challenge or the solutions here, but the core bug in the SNMP functionality was a parser differential that allowed you to make SNMP requests that were supposed to be disallowed.
To make up for missing this bug, and to hopefully make it more intuitive to spot something like this in the future, I implemented a basic ASN.1 parser and reimplemented the vulnerable parser from the challenge. Using these implementations I created a visualisation of the parser differential, which is iframed below (its also directly accessible here). Click the "Standard Input Example" and "Exploit Input Example" buttons to compare payloads. Once a payload is visualised, you can hover over the bytes to highlight ASN.1 objects.