Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ctf]

Capture the Flag (CTF) is a form of hacking competition. Use for questions about the design and operation of such contests. Do not use for questions asking for help with winning contests.

-1
votes
1answer
102 views

How to use Nmap as a port knocking client?

I want to use Nmap for port knocking on CTF machines, so I've read the manual for configuring it properly: nmap <ip> -p <port1>,<port2>,... -r --max-retries 0 --max-parallelism 1 ...
-1
votes
0answers
21 views

What encoding could this be? [duplicate]

I am currently doing a CTF and got stuck with this. D'N:^>!Z54WVxg5St?s0N;Kn%HZj43Dfec@a={)yxqYotsrk1ongf,dibgf%]baZYX]\Uy<;WPtT6RKoONMFKDhHGF(DCBA@9]765:981UT4ts10)M',%Ij(!~%|B"yx>v^zyxwvo5srkpoh....
0
votes
0answers
49 views

Meterpreter Upload won't work

I am trying to follow a walkthrough for a CTF and there is one point where i have to upload a unix-privesc-check file to the other machine. Well when i use the command i get this response upload /...
0
votes
1answer
655 views

Is there a way to exploit jquery 1.12.4 vulnerability?

According to https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery+1.12.4 and https://snyk.io/test/npm/jquery/1.12.4, I see that jQuery 1.12.4 has medium serevrity vulnerability. I checked on ...
1
vote
0answers
55 views

Help needed in identifying a string [closed]

I need help in identifying the following string in order to decode it to a piece of meaningful information. h_t_s_/_g_s_._k_l_b_c_m_4_9_a_k_6_f_8_4_8_e_e_r_9_3_9_f_
0
votes
0answers
39 views

Need help in finding flags in secret files [duplicate]

Need help in identifying or decrypting strings to find flags in capture the flag competitions. Please provide any guides or help.
2
votes
1answer
157 views

Risk involved with using SSH for CTF challenges? [duplicate]

I'm new to the INFOSEC scene and was intrigued by the concept of CTF challenges. I was hoping to get started with OverTheWire.org which requires you to SSH to their server to complete the challenges. ...
2
votes
0answers
57 views

Shellcode different on guide

I followed a guide to do narnia2 of overthewire and the shellcode generated by them was: h\x01\x01\x01\x01\x814$ri\x01\x011\xd2Rj\x04Z\x01\xe2R\x89\xe2jhh///sh/binj\x0bX\x89\xe3\x89\xd1\x99\xcd\x80 ...
79
votes
4answers
19k views

What exactly is CTF and how can I as programmer prepare for a CTF with beginner-friendly people?

I reached out to an old friend of mine who was a terrific programmer back in my school days and he invited me to attend one of the CTF events with his university group. This group seems very beginner ...
-5
votes
3answers
232 views

Difference between phpp, php, and phP? [closed]

I came across a ctf challenge where php file upload was restricted but phpp and phP were not. What other formats can php be uploaded in and what is the difference?
1
vote
2answers
109 views

Buffer Overflow problem [closed]

I have a quick question about a buffer-overflow exploit in a 64-bit binary. Lately, I have found some basic buffer overflow vulnerabilities. I hoped I knew how to manage it, but apparently, I don't. ...
1
vote
2answers
598 views

Shellcode does not execute as the owner

(This is a question regarding a challenge in a wargame on overthewire.org called Narnia) Here is the source code of the vulnerable script "narnia1" I intend to exploit: #include <stdio.h> int ...
2
votes
0answers
39 views

Function epilogue behavior since GCC 4.9.0

I'll use the following C code to explain my question: #include <stdio.h> int main(void) { printf("foo\n"); return 0; } Before GCC 4.9.0, disassemblying it produces: .LC0: .string ...
1
vote
1answer
211 views

zap proxy - modify post to inject a zip file

I am doing a CTF image now, and I need to upload a .zip file to execute using the php wrapper zip:// using this PHP ZIP Wrapper LFI vulnerability The problem is that the only way to upload is with ...
3
votes
1answer
3k views

How to use a sh SUID script to get privilege escalation?

As www-data user (non-privileged user) I have found this SUID, world-writable shell script: www-data@Cisco:/home/cripto$ ls -al /etc/init.d/admin -rwsr-xrwx 1 root bob 233 Nov 12 13:09 /etc/init.d/...
1
vote
1answer
2k views

SQL Injection - LIKE Clause

As part of a capture-the-flag assignment, I'm supposed to perform SQL injection using the LIKE clause to obtain the flag. I'm new to this and I've tried the following injections: (The username ...
2
votes
1answer
4k views

How to find a wep key inside a pcap file with only 2 IV?

I have a pcap file that contains 3 packets. I need to find a WEP key inside these packets. These packets contains only two IV. It's not a live attack so I can't try brute force.
0
votes
1answer
361 views

How exploitable is a QR code in a login system?

I'm taking a CTF challenge on a web service. The goal is to gather the most information possible of a user. I have access to it's login and password, but password is expired and the account must be ...
1
vote
1answer
3k views

Overwriting return address of main function

I am new to CTFs and I was asked to solve this: #include <cstdio> // g++ pwn2.cpp -o pwn2 -static void ilocamp() { char flaga[1024] = {0}; FILE *f = fopen("flag2.txt", "r"); ...
3
votes
1answer
299 views

Help choosing the right virtualization for a CTF [closed]

I am a High School cyber computer science teacher who also teaches courses on cyber security. I have been looking around for some good 'beginner' CTFs that I could organize for my students, but ...
3
votes
1answer
111 views

Are there any academic papers/books about hacking wargames?

I'm looking for sources (academic papers, books, articles from notable magazines) that can be used as reference for a Bachelor's Thesis, that should be about making an educational, gamified hacking ...
25
votes
4answers
3k views

Reduce Noise when Penetration Testing

Recently I participated in a capture the flag competition which was attached with SOC analysis teams monitoring our traffic. There we were told that many tools were very noisy. Eg Sqlmap which has ...
0
votes
1answer
431 views

From a local file inclusion to a shell when file is downloaded?

I've just participated in a boot2root capture the flag event where I got close to solving an item but couldn't quite get it over the line and want to learn what I could have done differently. In the ...
3
votes
1answer
196 views

Looking for a race condition example that we can use internally in training

I'm making a small CTF for my digital team to teach them about different exploits. I'm hoping to include a race condition example but everything I've found manipulates a local file or SQL database (so ...
3
votes
1answer
127 views

Ctf creation sandboxed question

I have a tiny question, we are creating a ctf but we stumbled upoun a idea that we don't know how to solve. As several websites that create ctf's as hack.me use sandboxes. Due to the security and ...
1
vote
0answers
317 views

kernel panic after exploiting dirty cow on kernel 3.13.0

After exploiting the dirty cow vulnerabillity https://www.exploit-db.com/exploits/40839/ my ubuntu virtual machine keep getting a kernel panic after every reboot. What could possibly cause this ...
4
votes
0answers
70 views

CSAW 2012 challenge2 can't get shell out side of gdb

I tried to solve this problem. I found FSB at 0x08048bfe _snprintf. I loaded shell code by \n. ssc function checks whether user input include /bin/sh. Most of shell code includes /bin/sh. I found ...
15
votes
1answer
3k views

Steganography - JPEGsnoop

I am trying to overcome a CTF steganography challenge. I tried different methods to unhide the hidden data in the file without luck. I used JPEGsnoop on the image and I got this output: *** Decoding ...
16
votes
4answers
4k views

How to build a hacking challenge that uses XSS?

Security conferences often have hacking challenges. My colleagues and I have built a number of these. We've not yet done one that includes a cross-site scripting vulnerability. I have seen challenges ...
0
votes
1answer
547 views

Is there a good site I can use to convert a string into any encoding? [closed]

I am working on a ctf (capture the flag) challenge and I have a string that I believe is important, but I don't know what encoding it is in. Is there a way I can decode the string in all of the ...
0
votes
3answers
1k views

Looking for some steganography guidance

I am currently trying to figure out a steganography challenge. I was given 3 images, a secret.txt file and a "binary" file. There are no instructions as this was part of another challenge. I am ...
0
votes
1answer
182 views

LFI Why would I not see a response

I have the below two vulnerable PHP code sections in 2 files. I found the sources of these in an anony access FTP backup file home.tar.gz. So I'm getting the content of /etc/passwd with the null byte ...
11
votes
1answer
496 views

Did DARPA's Cyber Grand Challenge winner actually discover previously unknown vulnerabilities?

DARPA announced a winner on August 4, 2016 of its Cyber Grand Challenge DARPA Cyber Grand Challenge. The contest was described as designed to accelerate the development of advanced, autonomous ...
4
votes
1answer
1k views

Exploiting MD5/Salt Vulnerability in this PHP form?

I've been practicing security-related subjects and this challenge has befuddled me. Note: I can't access any PHP source code, nor can I edit it. I'm only able to view it. The following is given: I ...
4
votes
3answers
541 views

Is this PHP code vulnerable SQL injection?

Im given control over the $vote variable (in the "challenge" function) Is there any way to sql inject the query? (BTW I can see/read whatever the challenge function returns e.g. the sql errors. I ...
7
votes
1answer
3k views

PHP Session Vulnerability

I'm trying to solve a challenge on a CTF, with PHP sessions. The goal is to make check.php echo $_PASSWORD. I do not have access to the files themselves, and therefore I cannot edit them. My ...
2
votes
2answers
825 views

How to decrypt text when four first letters of the key are missing in Facebook CTF contest?

I am beginner in cyber security. Now I am participating on Facebook Catch the Flag contest. I have to solve following task: There is a key. But the first four characters of the key are missing: _ _ ...
2
votes
1answer
6k views

How to bypass PHP username and password check in this CTF challenge?

I'm preparing for this CTF challenge I'll be participating in next week, and I ran across this problem online which I can't manage to solve. I only have control of the variables $user and $pass that ...
1
vote
1answer
2k views

Any CTF sites besides CTF365 [closed]

I am looking for free ctf sites like ctf365, but I want a challenge and not vulnerable-by-design machines. Any references?
2
votes
0answers
1k views

Apache Web Server ETag Header Information Disclosure Weakness

How this vulnerability allow remote attackers to obtain sensitive information likes inode number and child process though ETag header ? and how to locate path to a file from inode number ?
1
vote
1answer
559 views

Hosting a “Capture the Flag” style competition for fun and learning? [duplicate]

A few friends and I want to run some kind of CTF competition in which we both have identical OSes that we can attack and defend as teams/individuals. I was looking on the web and I found some good ...
14
votes
6answers
11k views

Designing a Capture The Flag target and game management system

I've attended several CTF contests and I'd like to implement a CTF system for my students. I asked Google about designing such system but it's fruitless. Any ideas?