Research Category
Articles about CTF
0x01 Introduction A while ago I created a misc challenge for the ByteCTF Masters competition. It grew out of my recent research into a middleware product, and I found the idea interesting enough to share the challenge-design process here. 0x02 A Small Joke Message-oriented middleware has become a key component of distributed systems and microservice architectures. Common products include ActiveMQ, Kafka, RabbitMQ, and RocketMQ…
1. File-upload JavaScript bypass: change the extension to bypass client-side validation. 2. Basic command execution: append a pipe and a command. 3. Can you brute-force it? The hint points to cookie injection. The captured username is Base64-encoded, so save the request to 1.txt and use SQLmap's Base64 tamper script: python2 sqlmap.py…
0x00 Preface I participated in this year's industrial security competition: five online rounds, an on-site semifinal for the top 60, and a final for the top 30. Our three-person team placed first in online round three, ninth in the semifinal, and seventh in the final. This article was written for a 90sec event, with some sections contributed by my teammates. 0x01 Online Round 3…
0x01 CheckIn. The Docker image failed, so only the approach is summarized. The challenge appears inspired by Insomni'hack 2019. Uploads fail if the file contains <?, has only an extension such as .htaccess or .txt, uses a forbidden extension…
0x00 Game. Inspecting the source reveals a suspicious JavaScript file. Sending a POST request with score=15 returns the data. 0x01 Who are you? The source suggests XML injection, and testing confirms an XXE vulnerability. Because the flag path is unknown, use php://filter…
0x01 Challenge description. 0x02 Detours. This is clearly an MP3 steganography challenge. Three conventional approaches come to mind: open it as text and search for 'flag'; inspect its waveform and spectrogram for Morse code; or check the MP3 for embedded files and extract them. The first idea found nothing. The waveform and spectrogram also contained no useful information…
0x01 Challenge. A substation uses IEC 61850 for data collection between the station and bay layers. Analyze the capture, learn the MMS protocol, and find the hidden flag. File: question_1531222544_JYvFGmLP49PFC0R2.pcap.zip. 0x02 Background. MMS is the Manufacturing Message Specification…
Preface These are organized notes from earlier challenges. I. Could You Log In? The prompt indicates injection and says everything is filtered, so we determine what. Submit username=' and or union select " -- #aa&password=. The response shows username:' and " aa, meaning or, union… are filtered.
PHP Exercise is clearly a code-execution challenge. My initial path used touch and file_put_contents to write a webshell, but the connection failed. Participants eventually damaged the environment and deleted files from the document root…
Preface. I was preparing for a CTF and practiced several Web challenges on XCTF. Challenge 1 is a basic penetration-testing warm-up: scan ports and then directories with AWVS. robots.txt reveals rob0t.php and the flag…