🚩YCTF0x02
YCTF Weekly 2 writeups
Last updated
YCTF Weekly 2 writeups
Last updated
Category: Reverse Engineering
Description: Dude, It's an easy challenge.
Challenge file: <link>
Credit: Munazir
Solution: Executing the binary on linux asks for the password.
Now, use strings to get the exact matching pattern for passphrase.
We got some strange string 4/*A1zqi!*9 before the Passphrase, let's try to enter the string when asked for the password.
After we enter the passphrase, we get something in HEX format.
594354467b336173795f7233765f643065736e315f723371753172335f627261316e7d
Pasting on cyberchef, we get the actual flag.
Category: Miscellaneus
Description: My friend is spying on our ycfteam website. But the page he was trying to access was never found later.
Link: https://ycfteam.in
Credit: Munazir
Hint:
Solution: Understand the challenge name and description, what does it say?
Never found Which indicated/ similar to Not found. searching the Archive web for the 404 not found page on https://ycfteam.in/404,
We get the flag!
Description: Well, there is only one way to survive.
Link: https://cookiechallenge.pythonanywhere.com/
Credit: Munazir
Solution: Visiting the URL, we get the following page to enter the name. Some of you might think it is vulnerable to XSS. But hold on!
Directory bruteforcing will lead to the following result which reveals /cookie and /robots.txt
Visiting the robots.txt, we get another directory /sup3r_s3cr3t_d1r
Visiting /cookie directory to get the cookie, and we get the JWT token.
Take the token and paste it on https://token.dev change the values as admin: true and answer: yes
Now visit the /cookie again and change the cookie and refresh the page.
Then visit the /sup3r_s3cr3t_d1r again to get the flag!!!!
Description: Don't run away from problems; facing and solving them is the key to success.
Link: http://yctfinternet.liveblog365.com/
Credit: Gourav Suram
Writeup link: https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs/yctf-week-2-9-dec-23/web-security
Description: Help my friend to download the flag.
Link: http://139.59.45.27:8090/admin/flag.tar.gz
Credit: Munazir
Writeup credit: Gourav Suram
Writeup link: https://heapbytes.gitbook.io/notes/ctf-writeups/2023-ctfs/yctf-week-2-9-dec-23/web-security/confluence
