Questions tagged [ctf]

Capture the Flag (CTF) is a form of hacking competition. Use for questions about the design and operation of such contests. Do not use for questions asking for help with winning contests.

Filter by
Sorted by
Tagged with
1
vote
0answers
48 views

How to fix TCP stream in Wireshark with spurious retransmission?

This was for a CTF (it ended yesterday, so I'm not cheating), but I've spent so many hours on it that I really just want to understand what I should have done. Here is the PasteBin Hex Dump. I ...
0
votes
0answers
49 views

How can I use nohup command to get root access of the target machine?

I am playing ctf and I have gained access to the target machine but not as root. I can see nohup utility has root access on the machine and I used this command to get the root access but that did not ...
0
votes
0answers
55 views

CTF setup for debugging heap exploits

I'm currently studying binary heap exploitation (mainly the glibc (ptmalloc2) implementation), for CTF competitions. The problem I'm facing is debugging challenges designed for a certain glibc version....
0
votes
0answers
38 views

URL Encoding leading to invalid flag

I'm currently completing an XSS challenge in a CTF. I successfully redirect the admin cookie to my request bin, but the flag is said to be invalid. I am told this is because the flag string gets ...
4
votes
3answers
169 views

Break out or bypass php functions

I'm currently doing an online CTF and I have LFI an can read the source code of the upload function. In there I see the following line: shell_exec('rm -rf ' . directory/ . '*.p*'); So anytime I ...
0
votes
0answers
188 views

XXE - possible to read directories?

I have come across XXE on a CTF a while ago and I can't get my head around where to go from where I am. <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [<!ENTITY xxe SYSTEM "php:...
0
votes
1answer
104 views

Using GET request to find html file

I'm doing a basic CTF at the moment. Using, GET / HTTP/1.1 Host: subdomain.domain.com I am getting the response: <a href="/c98efc0d-5c3f-45ec-996a-2cb82d35ed26.html">follow this link to get ...
6
votes
4answers
2k views

What is hacking hackable virtual machines useful for? [closed]

I was watching an ethical hacking course where the tutor taught me to hack into different virtual machines and also machines from Hack The Box. In the real world, how are these practices of hacking ...
0
votes
0answers
43 views

how to check offset for a program on remote server

I am solving pwn problems in CTF challenges. my exploits are working in the local system but it doesn't work on the remote server when connecting using Netcat. The issue was that even the function ...
0
votes
1answer
88 views

How to find vulnerable PHP parameter such as `.php?id=` as found in Kioptrix 3?

This is part of my preparation for OSCP. According to https://www.vulnhub.com/entry/kioptrix-level-12-3,24/, Kioptrix 3 is vulnerable to SQL Injection. However, I found that SQLi challenge on ...
1
vote
0answers
277 views

ZAP Error [java.net.ConnectException]: Connection refused (Connection refused)

I am trying to connect to http://challenge01.root-me.org/web-serveur/ch10/ in Firefox with FoxyProxy and OWASP ZAP and I got this error message ZAP Error [java.net.ConnectException]: Connection ...
0
votes
0answers
43 views

Connecting to REST server w/ digest auth using postman

Im having a hard time with a CTF, i managed to exploit a path traversal vulnerability that lead me to read a configuration file in php that indicates: define('rest_auth', 'digest'); define('...
2
votes
0answers
101 views

Retrieving a flag from vim commands by reading through strace output [CTF]

So, to clarify, I'm currently working on a CTF challenge that consists of running an strace over on a bash script that is running vim commands using commands like vim -c ":!cat flag.txt" inside of a ...
1
vote
0answers
142 views

SQL Injection only with OR

I am doing a practise SQL injection in a search field and I don't understand the logic of what is happening. The following behaviours is what I noticed: Entering ' OR '1' = '1 shows all the results. ...
1
vote
0answers
19 views

How editing html and javascript of a website makes it vulnerable? [duplicate]

I was practicing web pentesting on this level of ctf2 and I was supposed to edit the HTML and the Javascript to get rid of the input validation and < > sanitization. I succeded after looking up ...
1
vote
0answers
335 views

Hydra - Brute force command is stalling

Very new to application testing here. I am working through the hacker101 CTF (petshop) examples and I am having problems with brute forcing a username form with Hydra. The error message looks like it ...
2
votes
1answer
591 views

Hacker101 Spoilter #2 EASY Micro-CMS v1

I am just getting into CTF and Hacking in general. I am very confused as to why this worked when I added an apostrophe to the end it reveals the flag. I have Burp Community Edition suite going and I ...
0
votes
1answer
155 views

Extract data from burp response and use in another request

I have a scenario where I need to call /api/login to get a token and then use said token in subsequent calls until it expires. Is there a way to automate the call and token extraction and then to ...
1
vote
1answer
405 views

Protect server in CTF challenge when exploting input() vulnerability in python

There was this challenge in one of the CTF's I played in which you had to exploit the input vulnerability of Python 2.x . I was just wondering that since the input function in Python 2.x is same as ...
0
votes
0answers
421 views

How to produce remote code execution via pickling an object

I'm working on a challenge that was presented to me without much prior knowledge of Python and the pickle library. I'm unable to post the challenge's code for reasons. In short though I am accessing ...
11
votes
2answers
2k views

Understanding SQLMAP payload

I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution ...
0
votes
2answers
295 views

Pickle Shellcode Import Error

I'm trying to execute pickle shell-code through a download function on a website but I get the following error: <html> <h1>ERROR: Cannot load file</h1> <!-- Traceback (most ...
0
votes
2answers
2k views

How to use Nmap as a port knocking client?

I want to use Nmap for port knocking on CTF machines, so I've read the manual for configuring it properly: nmap <ip> -p <port1>,<port2>,... -r --max-retries 0 --max-parallelism 1 ...
2
votes
1answer
9k views

Is there a way to exploit jquery 1.12.4 vulnerability?

According to https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery+1.12.4 and https://snyk.io/test/npm/jquery/1.12.4, I see that jQuery 1.12.4 has medium serevrity vulnerability. I checked on ...
1
vote
0answers
89 views

Help needed in identifying a string [closed]

I need help in identifying the following string in order to decode it to a piece of meaningful information. h_t_s_/_g_s_._k_l_b_c_m_4_9_a_k_6_f_8_4_8_e_e_r_9_3_9_f_
0
votes
0answers
42 views

Need help in finding flags in secret files [duplicate]

Need help in identifying or decrypting strings to find flags in capture the flag competitions. Please provide any guides or help.
2
votes
1answer
456 views

Risk involved with using SSH for CTF challenges? [duplicate]

I'm new to the INFOSEC scene and was intrigued by the concept of CTF challenges. I was hoping to get started with OverTheWire.org which requires you to SSH to their server to complete the challenges. ...
2
votes
0answers
93 views

Shellcode different on guide

I followed a guide to do narnia2 of overthewire and the shellcode generated by them was: h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80 ...
80
votes
5answers
27k views

What exactly is CTF and how can I as programmer prepare for a CTF with beginner-friendly people?

I reached out to an old friend of mine who was a terrific programmer back in my school days and he invited me to attend one of the CTF events with his university group. This group seems very beginner ...
-5
votes
3answers
292 views

Difference between phpp, php, and phP? [closed]

I came across a ctf challenge where php file upload was restricted but phpp and phP were not. What other formats can php be uploaded in and what is the difference?
1
vote
2answers
148 views

Buffer Overflow problem [closed]

I have a quick question about a buffer-overflow exploit in a 64-bit binary. Lately, I have found some basic buffer overflow vulnerabilities. I hoped I knew how to manage it, but apparently, I don't. ...
1
vote
2answers
1k views

Shellcode does not execute as the owner

(This is a question regarding a challenge in a wargame on overthewire.org called Narnia) Here is the source code of the vulnerable script "narnia1" I intend to exploit: #include <stdio.h> int ...
2
votes
0answers
56 views

Function epilogue behavior since GCC 4.9.0

I'll use the following C code to explain my question: #include <stdio.h> int main(void) { printf("foo\n"); return 0; } Before GCC 4.9.0, disassemblying it produces: .LC0: .string ...
1
vote
1answer
285 views

zap proxy - modify post to inject a zip file

I am doing a CTF image now, and I need to upload a .zip file to execute using the php wrapper zip:// using this PHP ZIP Wrapper LFI vulnerability The problem is that the only way to upload is with ...
3
votes
1answer
4k views

How to use a sh SUID script to get privilege escalation?

As www-data user (non-privileged user) I have found this SUID, world-writable shell script: www-data@Cisco:/home/cripto$ ls -al /etc/init.d/admin -rwsr-xrwx 1 root bob 233 Nov 12 13:09 /etc/init.d/...
1
vote
1answer
3k views

SQL Injection - LIKE Clause

As part of a capture-the-flag assignment, I'm supposed to perform SQL injection using the LIKE clause to obtain the flag. I'm new to this and I've tried the following injections: (The username ...
2
votes
1answer
8k views

How to find a wep key inside a pcap file with only 2 IV?

I have a pcap file that contains 3 packets. I need to find a WEP key inside these packets. These packets contains only two IV. It's not a live attack so I can't try brute force.
0
votes
1answer
480 views

How exploitable is a QR code in a login system?

I'm taking a CTF challenge on a web service. The goal is to gather the most information possible of a user. I have access to it's login and password, but password is expired and the account must be ...
1
vote
1answer
5k views

Overwriting return address of main function

I am new to CTFs and I was asked to solve this: #include <cstdio> // g++ pwn2.cpp -o pwn2 -static void ilocamp() { char flaga[1024] = {0}; FILE *f = fopen("flag2.txt", "r"); ...
3
votes
1answer
475 views

Help choosing the right virtualization for a CTF [closed]

I am a High School cyber computer science teacher who also teaches courses on cyber security. I have been looking around for some good 'beginner' CTFs that I could organize for my students, but ...
3
votes
1answer
135 views

Are there any academic papers/books about hacking wargames?

I'm looking for sources (academic papers, books, articles from notable magazines) that can be used as reference for a Bachelor's Thesis, that should be about making an educational, gamified hacking ...
25
votes
4answers
4k views

Reduce Noise when Penetration Testing

Recently I participated in a capture the flag competition which was attached with SOC analysis teams monitoring our traffic. There we were told that many tools were very noisy. Eg Sqlmap which has ...
0
votes
1answer
491 views

From a local file inclusion to a shell when file is downloaded?

I've just participated in a boot2root capture the flag event where I got close to solving an item but couldn't quite get it over the line and want to learn what I could have done differently. In the ...
2
votes
1answer
276 views

Looking for a race condition example that we can use internally in training

I'm making a small CTF for my digital team to teach them about different exploits. I'm hoping to include a race condition example but everything I've found manipulates a local file or SQL database (so ...
3
votes
1answer
197 views

Ctf creation sandboxed question

I have a tiny question, we are creating a ctf but we stumbled upoun a idea that we don't know how to solve. As several websites that create ctf's as hack.me use sandboxes. Due to the security and ...
1
vote
0answers
363 views

kernel panic after exploiting dirty cow on kernel 3.13.0

After exploiting the dirty cow vulnerabillity https://www.exploit-db.com/exploits/40839/ my ubuntu virtual machine keep getting a kernel panic after every reboot. What could possibly cause this ...
4
votes
0answers
76 views

CSAW 2012 challenge2 can't get shell out side of gdb

I tried to solve this problem. I found FSB at 0x08048bfe _snprintf. I loaded shell code by \n. ssc function checks whether user input include /bin/sh. Most of shell code includes /bin/sh. I found ...
15
votes
1answer
3k views

Steganography - JPEGsnoop

I am trying to overcome a CTF steganography challenge. I tried different methods to unhide the hidden data in the file without luck. I used JPEGsnoop on the image and I got this output: *** Decoding ...
15
votes
4answers
6k views

How to build a hacking challenge that uses XSS?

Security conferences often have hacking challenges. My colleagues and I have built a number of these. We've not yet done one that includes a cross-site scripting vulnerability. I have seen challenges ...
0
votes
1answer
820 views

Is there a good site I can use to convert a string into any encoding? [closed]

I am working on a ctf (capture the flag) challenge and I have a string that I believe is important, but I don't know what encoding it is in. Is there a way I can decode the string in all of the ...