Collaborate Disseminate
I have a file service on a port that I need to crash in order to find the flag. I tried to send a lot of data using python socket.send() with commands like "../" for the data. However, I just get b” in return instead of a crash…. Continue reading How to crash a file service [closed]
Among all the things you could find at MCH2022, there were a few CTFs (Capture The Flag exercises) – in particular, every badge contained an application that you could try …read more Continue reading MCH2022 Badge CTF Solved, With Plenty To Learn From
This was covered in Linux PrivEsc, task 15, in this TryHackMe room.
I am having trouble understanding how this debugging mode is executing the commands in the PS4 variable, and why I must put /usr/local/bin/suid-env2 instead of another pat… Continue reading Abusing Shell Feature for Privilege Escalation
The question in a CTF was this:
They used two hydrogen atoms (H2) from the SHA-256 molecule to encrypt
in some form of AES, and the result was as follows:
{mIT+GVt+p0YfgfOltHgqoetTS6h8bRSAScAGKrBE+g8TJfgsjeiX4/tloGU1In9j42l+zlAnI0+hmbgzpO… Continue reading CTF Crypto question
I was doing the following PortSwigger Lab on cross site scripting (XSS).
The following payload works perfectly.
http://foo?'-alert(1)-'
Which is input into the following section of the webpage.
<img src="/resourc… Continue reading How does this PortSwigger lab’s XSS work?
I am playing with a Linux CTF server and came across a kind of reverse connection block. I uploaded a php webshell, gained control of www-data user and tried to make a reverse shell.
Possible a UFW block at 1024~UP ports. In this server, I… Continue reading I cannot make a reverse connection
Hosted by the Korean Institute of Information Security and Cryptology (KIISC), the Digital Forensics Challenge 2022 (DFC 2022) aims to expand our knowledge of digital forensics and to contribute to this field. Now in its fifth year, the challenge plays… Continue reading Digital Forensics Challenge 2022 (DFC 2022)
I was reading into the basics of SQL injection attacks on w3schools here.
In the second example, I was curious as to why the equal sign was used. I have quoted within the line below.
" or ""="
Is there any particular … Continue reading Why does this SQL injection have an equals symbol?
useless question, sorry, kindly delete
Continue reading How to solve this CTF challenge (encoding)? [closed]
This article covers the solution for the LDAP challenges on a capture the flag.
I understand how the first example works, using the NULL value for the username and password to authenticate to the LDAP exploiting NULL Bind. I understood the… Continue reading Metasploit module for NULL LDAP credentials