Questions tagged [ctf]

Capture the Flag (CTF) is a form of hacking competition. Use for questions about the design and operation of such contests. Do not use for questions asking for help with winning contests.

Filter by
Sorted by
Tagged with
1 vote
1 answer
75 views

Why does this SQL injection have an equals symbol?

I was reading into the basics of SQL injection attacks on w3schools here. In the second example, I was curious as to why the equal sign was used. I have quoted within the line below. " or "&...
user avatar
0 votes
0 answers
37 views

Metasploit module for NULL LDAP credentials

This article covers the solution for the LDAP challenges on a capture the flag. I understand how the first example works, using the NULL value for the username and password to authenticate to the LDAP ...
user avatar
1 vote
1 answer
97 views

Why when i nmap scan a machine i get the port 554 (RTSP) open?

I train on vulnerable boxes and during my recon phase, I use nmap to collect info on open ports. I use the command nmap -sS [IP|URL] and no matter the machine, I get the result that port 554 - RTSP ...
user avatar
0 votes
0 answers
54 views

How to perform php post request attack with javascript sanitization?

The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable ...
user avatar
1 vote
0 answers
45 views

C - Remote string format attack exploit - %n Does not seem to write anything on the stack

[As part of a ctf] I am trying to exploit a remote server through a tcp connection. The server is using snprintf() and provides user input as the formatting string. My goal is to dump the stack. ...
user avatar
0 votes
0 answers
101 views

ROP-Attack on picoCTF challenge

I was trying to solve the picoCTF challenge filtered-shellcode. I started by trying to get the base-address of the libc library and executing system or execve. Important to note is that you can only ...
user avatar
  • 1
1 vote
1 answer
154 views

Payload uploaded but error : "no session was created"

I'm doing a capture-the-flag challenge (similar to HackTheBox) and I can't figure it out despite looking at many workarounds how to solve my issue. I did: nmap --> got port 8080 firefox -> 10....
user avatar
  • 113
0 votes
0 answers
64 views

Is it possible to create an NTFS partition having only the $MFT and $J tables ? Forensics CTF

This is the third part of a forensics challenge in a European CTF, and it is apparently the most difficult one because only three people flagged it among 700 participating. I'm only here for guidance ...
user avatar
1 vote
1 answer
106 views

Some introductory reverse engineering help on finding a string

I understand the crackme I am researching is from 2007, however this was the point in my life when I initially became interested in reverse engineering and wish to complete it for nostalgia sake. ...
user avatar
0 votes
1 answer
127 views

Segfault after reaching system

I'm doing a pretty bog-standard return-to-libc attack and I'm in a bit of a pickle. I first got the entire attack working with my local version of libc, then I used the version of libc provided by the ...
user avatar
  • 101
0 votes
0 answers
145 views

Sudo -l systemctl bypass

I am trying to privilege escalate a vulnerable box and I've stuck with this output: sudo -l Matching Defaults entries for charlie on sewers: env_reset, mail_badpass, secure_path=/usr/local/...
user avatar
0 votes
0 answers
83 views

Retrieving data in a particular address found from ROPgadget

I am trying to solve a CTF challenge which involves return oriented programming. The challenge is here: https://ctflearn.com/challenge/1012 I used the ROPgadget tool to search for gadgets in the ...
user avatar
1 vote
0 answers
136 views

ctf kernel challenges does not work [closed]

I'm trying to learn and solve some 'kernel related' ctf challenges (reading writups to try to run same environment and achieve root using one of the kernel-pwn technique...). I'm using Ubuntu 20 VM ...
user avatar
  • 11
1 vote
2 answers
632 views

Cracking diffie-hellman public key to obtain shared key

I'm given 2 prime numbers, g and n, as well 2 public keys, ga mod n and gb mod n, as part of a leaked Diffie hellman key exchange. I need to derive the shared key gab mod n using the given information....
user avatar
0 votes
1 answer
180 views

how to do a pentest to /assets/js/login.js [closed]

Hey guys this is my first question in this kind of platform. I made a pentest a vulnerable machine this is like a web page video content there are not much target vectors. In my attack a detect only ...
user avatar
  • 1
0 votes
2 answers
439 views

Is union based mysql injection able to read files outside database?

Can files outside database which are not part of any tables in database be read via union based SQL injection? For eg http://xyz.com/fetch?id=3 Consider id parameter is used at server side by cursor ...
user avatar
1 vote
0 answers
223 views

CyberChef Challenge #21 [closed]

The challenge data is: ...
user avatar
0 votes
0 answers
627 views

Exploit apache2 service as member of www-data group

I am attempting to solve a CTF challenge where I am logged in as a member of the www-data group and the apache2 service is misconfigured and can be run as sudo without a password. What I am attempting ...
user avatar
0 votes
1 answer
394 views

Steganography CTF question

I have recently participated in a CTF competition and failed in the following stage where the solution was never revealed. After a really hard job I got access to a text file that contains a really ...
user avatar
0 votes
0 answers
216 views

how to hack rbash --?

I'm solving CTF challenge, and have to escalate the privilege from user1 to user2, $HOME is read-only, so i can't change $HOME/.bashrc. sudo -l shows (user2) NOPASSOWRD: /usr/rbash -- i can't write ...
user avatar
  • 103
1 vote
0 answers
106 views

How to secure home environment when testing vulnerable VMs

I'd like to practice CTFs and cyber attacks on vulnerable VMs downloaded from seemingly reputable sources. Which are the basic guidelines for securing the environment and avoid that malware (if any) ...
user avatar
  • 131
1 vote
0 answers
515 views

How to fix TCP stream in Wireshark with spurious retransmission?

This was for a CTF (it ended yesterday, so I'm not cheating), but I've spent so many hours on it that I really just want to understand what I should have done. Here is the PasteBin Hex Dump. I ...
user avatar
0 votes
0 answers
147 views

How can I use nohup command to get root access of the target machine?

I am playing ctf and I have gained access to the target machine but not as root. I can see nohup utility has root access on the machine and I used this command to get the root access but that did not ...
user avatar
2 votes
1 answer
556 views

CTF setup for debugging heap exploits

I'm currently studying binary heap exploitation (mainly the glibc (ptmalloc2) implementation), for CTF competitions. The problem I'm facing is debugging challenges designed for a certain glibc version....
user avatar
0 votes
0 answers
96 views

URL Encoding leading to invalid flag

I'm currently completing an XSS challenge in a CTF. I successfully redirect the admin cookie to my request bin, but the flag is said to be invalid. I am told this is because the flag string gets ...
user avatar
4 votes
3 answers
413 views

Break out or bypass php functions

I'm currently doing an online CTF and I have LFI an can read the source code of the upload function. In there I see the following line: shell_exec('rm -rf ' . directory/ . '*.p*'); So anytime I ...
user avatar
  • 191
1 vote
1 answer
4k views

XXE - possible to read directories?

I have come across XXE on a CTF a while ago and I can't get my head around where to go from where I am. <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [<!ENTITY xxe SYSTEM "php:...
user avatar
  • 277
0 votes
1 answer
191 views

Using GET request to find html file

I'm doing a basic CTF at the moment. Using, GET / HTTP/1.1 Host: subdomain.domain.com I am getting the response: <a href="/c98efc0d-5c3f-45ec-996a-2cb82d35ed26.html">follow this link to get ...
user avatar
6 votes
4 answers
3k views

What is hacking hackable virtual machines useful for? [closed]

I was watching an ethical hacking course where the tutor taught me to hack into different virtual machines and also machines from Hack The Box. In the real world, how are these practices of hacking ...
user avatar
0 votes
0 answers
100 views

how to check offset for a program on remote server

I am solving pwn problems in CTF challenges. my exploits are working in the local system but it doesn't work on the remote server when connecting using Netcat. The issue was that even the function ...
user avatar
0 votes
1 answer
635 views

How to find vulnerable PHP parameter such as `.php?id=` as found in Kioptrix 3?

This is part of my preparation for OSCP. According to https://www.vulnhub.com/entry/kioptrix-level-12-3,24/, Kioptrix 3 is vulnerable to SQL Injection. However, I found that SQLi challenge on ...
user avatar
  • 337
1 vote
0 answers
2k views

ZAP Error [java.net.ConnectException]: Connection refused (Connection refused)

I am trying to connect to http://challenge01.root-me.org/web-serveur/ch10/ in Firefox with FoxyProxy and OWASP ZAP and I got this error message ZAP Error [java.net.ConnectException]: Connection ...
user avatar
1 vote
0 answers
368 views

Print contents of PHP file in CTF

I am working with a PHP vulnerability. Below is the code snippet. Basically, I need to print the contents of get_flag.php. My train of thought is that the following could be the vulnerabilities in the ...
user avatar
2 votes
0 answers
342 views

Retrieving a flag from vim commands by reading through strace output [CTF]

So, to clarify, I'm currently working on a CTF challenge that consists of running an strace over on a bash script that is running vim commands using commands like vim -c ":!cat flag.txt" inside of a ...
user avatar
1 vote
0 answers
190 views

SQL Injection only with OR

I am doing a practise SQL injection in a search field and I don't understand the logic of what is happening. The following behaviours is what I noticed: Entering ' OR '1' = '1 shows all the results. ...
user avatar
1 vote
0 answers
19 views

How editing html and javascript of a website makes it vulnerable? [duplicate]

I was practicing web pentesting on this level of ctf2 and I was supposed to edit the HTML and the Javascript to get rid of the input validation and < > sanitization. I succeded after looking up ...
user avatar
  • 121
1 vote
0 answers
719 views

Hydra - Brute force command is stalling

Very new to application testing here. I am working through the hacker101 CTF (petshop) examples and I am having problems with brute forcing a username form with Hydra. The error message looks like it ...
user avatar
  • 11
2 votes
1 answer
691 views

Hacker101 Spoilter #2 EASY Micro-CMS v1

I am just getting into CTF and Hacking in general. I am very confused as to why this worked when I added an apostrophe to the end it reveals the flag. I have Burp Community Edition suite going and I ...
user avatar
  • 123
0 votes
1 answer
469 views

Extract data from burp response and use in another request

I have a scenario where I need to call /api/login to get a token and then use said token in subsequent calls until it expires. Is there a way to automate the call and token extraction and then to ...
user avatar
  • 123
1 vote
1 answer
687 views

Protect server in CTF challenge when exploting input() vulnerability in python

There was this challenge in one of the CTF's I played in which you had to exploit the input vulnerability of Python 2.x . I was just wondering that since the input function in Python 2.x is same as ...
user avatar
  • 11
0 votes
0 answers
1k views

How to produce remote code execution via pickling an object

I'm working on a challenge that was presented to me without much prior knowledge of Python and the pickle library. I'm unable to post the challenge's code for reasons. In short though I am accessing ...
user avatar
  • 109
11 votes
2 answers
4k views

Understanding SQLMAP payload

I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution ...
user avatar
0 votes
2 answers
493 views

Pickle Shellcode Import Error

I'm trying to execute pickle shell-code through a download function on a website but I get the following error: <html> <h1>ERROR: Cannot load file</h1> <!-- Traceback (most ...
user avatar
  • 1
1 vote
2 answers
5k views

How to use Nmap as a port knocking client?

I want to use Nmap for port knocking on CTF machines, so I've read the manual for configuring it properly: nmap <ip> -p <port1>,<port2>,... -r --max-retries 0 --max-parallelism 1 ...
user avatar
  • 1,097
2 votes
1 answer
15k views

Is there a way to exploit jquery 1.12.4 vulnerability?

According to https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery+1.12.4 and https://snyk.io/test/npm/jquery/1.12.4, I see that jQuery 1.12.4 has medium serevrity vulnerability. I checked on ...
user avatar
  • 123
1 vote
0 answers
127 views

Help needed in identifying a string [closed]

I need help in identifying the following string in order to decode it to a piece of meaningful information. h_t_s_/_g_s_._k_l_b_c_m_4_9_a_k_6_f_8_4_8_e_e_r_9_3_9_f_
user avatar
0 votes
0 answers
42 views

Need help in finding flags in secret files [duplicate]

Need help in identifying or decrypting strings to find flags in capture the flag competitions. Please provide any guides or help.
user avatar
2 votes
1 answer
758 views

Risk involved with using SSH for CTF challenges? [duplicate]

I'm new to the INFOSEC scene and was intrigued by the concept of CTF challenges. I was hoping to get started with OverTheWire.org which requires you to SSH to their server to complete the challenges. ...
user avatar
2 votes
0 answers
157 views

Shellcode different on guide

I followed a guide to do narnia2 of overthewire and the shellcode generated by them was: h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80 ...
user avatar
  • 123
82 votes
5 answers
30k views

What exactly is CTF and how can I as programmer prepare for a CTF with beginner-friendly people?

I reached out to an old friend of mine who was a terrific programmer back in my school days and he invited me to attend one of the CTF events with his university group. This group seems very beginner ...
user avatar