Wizard You have stumbled upon a wizard on your path to the flag. You must answer his questions! PS (not challenge related), thank you so much to Hadrian for supporting NahamCon 2022! Press the Start button on the top-right to begin this challenge. Solving To solve this challenge, you need to connect to your own instance via netcat. Then you
EXtravagant I’ve been working on a XML parsing service. It’s not finished but there should be enough for you to try out. The flag is in /var/www Press the Start button on the top-right to begin this challenge. Solving To solve this one, we need to upload our own malformed XML document (XML external entity (XXE) injection). Create a XML
SQLiLite Description Can you login to this website? Try to login here. Solving Connecting to the website will give us a login form. Assuming for a sql injection (title of the task) we try to login via ' or 1=1– for username and password. This works… the flag should be in plainsight… okay then the sourcecode or selecting everything again…
SQL Direct Description Connect to this PostgreSQL server and find the flag! The connectionsettings could be different on your side. psql -h saturn.picoctf.net -p 59911 -U postgres pico Password is ‚postgres‘ Solving With the given connectionstring we can log into the postgres database There we just need to ‚SELECT‘ what we want. With ‚\l‘ you can list the databases and
Secrets Description We have several pages hidden. Can you find the one with the flag? The website is running here. Solving Visiting the website does not really help… but the hint tells that there are some folders. Because gobuster or other fuzzing tools in CTF is not really nice to the infrastructure I tested the usual things: robots.txt -> nothing
Search source Description The developer of this website mistakenly left an important artifact in the website source, can you find it? The website is here. Solving Downloading whole website via ‚wget –recursive http://saturn.picoctf.net:56849/‘ Then you coud easily grep the sourcefiles for the flag. #!/bin/bash echo "Downloading website…" wget –recursive http://saturn.picoctf.net:56849/ > /dev/null 2>&1 echo "Changing DIR Name…" mv saturn.picoctf.net:56849 website
Roboto Sans Description The flag is somewhere on this web application not necessarily on the website. Find it. Check this out. Solving Visit the website Digging in the sourcecode – nothing there Looking the low-hanging fruits robots.txt — this is interesting In the robots.txt there are some base64 encoded strings decoding it point us to ‚js/myfile.txt‘
Local Authority Description Can you get the flag? Go to this website and see what you can discover. Solving Downloaded website via ‚wget http://saturn.picoctf.net:50959/‘ Looked at the site – just a normal site with a login prombt. Looking at sourcecode. Action is calling ‚login.php‘ — downloading as well In ‚login.php‘ a ’secure.js‘ is included… downloading There is a password in
Inspect HTML Description Can you get the flag? Go to this website and see what you can discover. Solving Downloaded website via ‚wget http://saturn.picoctf.net:49609/‘ or inspect the website directly. Looked into the file via ‚vi‘. At the end is a comment with the flag. For flag use ‚./get_flag.sh‘ #!/bin/bash wget "http://saturn.picoctf.net:49609/index.html" grep -o "picoCTF{.*}" index.html rm -rf index.html
Includes Description Can you get the flag? Go to this website and see what you can discover. Solving The flag is hidden in the website… more or less. We have to look into the css and js file. Then we will find the flag! In the CSS file is part 1 of the flag and in the javascript file you