Technical Tag
3 related articles.
1. File-upload JavaScript bypass: change the extension to bypass client-side validation. 2. Basic command execution: append a pipe and a command. 3. Can you brute-force it? The hint points to cookie injection. The captured username is Base64-encoded, so save the request to 1.txt and use SQLmap's Base64 tamper script: python2 sqlmap.py…
PHP Exercise is clearly a code-execution challenge. My initial path used touch and file_put_contents to write a webshell, but the connection failed. Participants eventually damaged the environment and deleted files from the document root…
Preface. I was preparing for a CTF and practiced several Web challenges on XCTF. Challenge 1 is a basic penetration-testing warm-up: scan ports and then directories with AWVS. robots.txt reveals rob0t.php and the flag…