NGA

CTF/2020 Google CTF → (4)건

2020 Google CTF Web ALL THE LITTLE THINGS 298pt

ALL THE LITTLE THINGS I left a little secret in a note, but it's private, private is safe. Note: TJMike🎤 from Pasteurize is also logged into the page. https://littlethings.web.ctfcompetition.com username, Profile image를 통해 Login을 할 수 있으며 /settings, /note, /logout 페이지와 user.js, utils.js, theme.js 가 존재한다. /static/scripts/user.js User Class와 make_user_object 함수가 정의되어 있다. class User { #username; #th..
CTF/2020 Google CTF 2020. 8. 26. 23:00

2020 Google CTF Web TECH SUPPORT 136pt

TECH SUPPORT Try chatting with tech support about getting a flag. Note: We have received multiple reports of exploits not working remotely, but we triple checked and concluded that the bot is working properly. https://typeselfsub.web.ctfcompetition.com/ 회원가입과 로그인을 통해 Me, Flag, Chat 서비스를 사용할 수 있다. Flag 페이지는 chat user만 접근 가능하며 Flag를 얻기 위해 chat user의 권한을 탈취해야 한다. 자신만이 볼 수 있는 /me 페이지는 사용자의 Address 값..
CTF/2020 Google CTF 2020. 8. 26. 21:06

2020 Google CTF Web LOG-ME-IN 87pt

LOG-ME-IN Log in to get the flag https://log-me-in.web.ctfcompetition.com/ username이 michelle이면 flag를 읽을 수 있다. SQL query를 prepare statement로 실행하지만 u값과 p값을 Array로 전달하게 되면 SQL Injection이 발생하게 된다. app.use(bodyParser.urlencoded({ extended: true })) ..... app.post('/login', (req, res) => { const u = req.body['username']; const p = req.body['password']; const con = DBCon(); // mysql.createConnection(...
CTF/2020 Google CTF 2020. 8. 25. 15:46

2020 Google CTF Web Pasteurize 50pt

PASTEURIZE This doesn't look secure. I wouldn't put even the littlest secret in here. My source tells me that third parties might have implanted it with their little treats already. Can you prove me right? https://pasteurize.web.ctfcompetition.com/ 웹페이지를 접속하면 글을 작성할 수 있는 간단한 form이 존재하고 /source로 Server Source code를 얻을 수 있다. Pasteurize Create new paste Source POST content값이 script tag내 note 변수에 필터..
CTF/2020 Google CTF 2020. 8. 25. 15:27
◀ 1 ▶

티스토리툴바