Hello guys ! Long time no write !
Today , I come back to my blog with NahamCon CTF which is held about 1 week ago.
I had solved some web challenges and absorbed many things useful 👅
Let's start!
Thứ Tư, 17 tháng 6, 2020
Thứ Sáu, 22 tháng 5, 2020
[Root-Me] JWT Revoked Token
Hi guys , after nearly 2 months dont care about Root Me challenges , I come back to it and realize that some challenges have been added to Web Serveur catalog recently . I decide to play with JWT again . 😃
25 Points , not too much hard , huh? I though so . And after solved this chall , I have to say : " It's not really hard , but so much tricky" . Let's see !
25 Points , not too much hard , huh? I though so . And after solved this chall , I have to say : " It's not really hard , but so much tricky" . Let's see !
Thứ Năm, 14 tháng 5, 2020
[PenTest] L*G.vn XSS detecting and exploiting!
Hi ,
Today, I will show you some interesting stuff which I have just done .
My friend want to buy a backpack from this website, she sent web address to me and asked me how the backpack was .
I dont really care about backpack.
In my vision, the only thing exist is the search engine on the left side.
Today, I will show you some interesting stuff which I have just done .
My friend want to buy a backpack from this website, she sent web address to me and asked me how the backpack was .
I dont really care about backpack.
In my vision, the only thing exist is the search engine on the left side.
Thứ Sáu, 8 tháng 5, 2020
[Securinets] Writeup jeopardy !
Hi guys.
Corona Virus aka Covid-19 has spreaded all over the world , we much #stayhome to protect our shelves . So , I have very much time to learning and training my hacking skill . This month ,with my team, I has participated in Securinets ctf competition . Very interesing , it has many , many things to discuss . Here is the result .
Corona Virus aka Covid-19 has spreaded all over the world , we much #stayhome to protect our shelves . So , I have very much time to learning and training my hacking skill . This month ,with my team, I has participated in Securinets ctf competition . Very interesing , it has many , many things to discuss . Here is the result .
Thứ Ba, 4 tháng 2, 2020
[WRITEUP] XML EXTERNAL ENTITY (XXE) INJECTION ROOTME
AFTER TET HOLIDAYS, WE FACE TO THE CORONA(2019-nCoV) VIRUS ,SO WE MUST PROTECT OURSELVES AND LIMIT TO GO TO PUBLIC PLACE . AS A OPTIMIST, IT'S MY RELAXING TIME TO CONTINUE TO SOLVE ROOT-ME CHALLENGE 😃 . TODAY , WE HAVE XXE INJECTION . LET'S START!
Thứ Tư, 18 tháng 12, 2019
[wargame.kr&rootme] PHP TYPE CONFUSION & LOOSE COMPARISON WRITEUP!
FIRST OF ALL , WE SHOULD FOCUS ON THE DEFINITION
A loose comparison is one performed using two equals signs (==
).It follows suit with the “best-guess” approach, which can lead to some unexpected results.
TAKE A LOOK INTO THIS TABLEThứ Hai, 9 tháng 12, 2019
[WARGAME.KR] MD5 PASSWORD VULNERABILITY WRITEUP!
THIS CHALL IS TO SUBMIT A PASSWORD WHICH WILL BE SENT TO md5($ps,true) FUNCTION AND THIS MD5 PASSWORD IS A PART OF THIS SQL QUERY :
FIRST, TAKE A LOOK AT MD5() FUNCTION DEFINITION AND IT'S VULENERABILITY :
string md5 ( string $str , [ bool $raw_output = false ] )
$row=@mysql_fetch_array(mysql_query("select * from admin_password where password='".md5($ps,true)."'"));OFCORSE WE DONT HAVE IDEA ABOUT PASSWORD , SO WE MUST FIND A WAY TO BYPASS THIS QUERY BY SQL INJECTION !
FIRST, TAKE A LOOK AT MD5() FUNCTION DEFINITION AND IT'S VULENERABILITY :
string md5 ( string $str , [ bool $raw_output = false ] )
Thứ Tư, 9 tháng 10, 2019
[WRITEUP] SQL INJECTION -ROUTED ROOTME
THEO ĐÁNH GIÁ CHỦ QUAN , CHALL NÀY KHÔNG QUÁ KHÓ , NHƯNG MỚI LẠ Ở CÁCH TIẾP CẬN VÀ THỰC THI QUERY
TRONG BÀI NÀY MÌNH SẼ KHÔNG GHI RÕ NHỮNG CÂU QUERY RA , CHỈ SHOW KẾT QUẢ VÀ CÁC BƯỚC CƠ BẢN ĐỂ THỰC THI :D
MỞ ĐẦU CHALL LÀ FORM KHÁ QUEN THUỘC , ĐỪNG AI DẠI DỘT FUZZ VÀO CÁI FORM NÀY NHÉ :D . CHUYỂN QUA TRANG "SEARCH" ĐI !
TRONG BÀI NÀY MÌNH SẼ KHÔNG GHI RÕ NHỮNG CÂU QUERY RA , CHỈ SHOW KẾT QUẢ VÀ CÁC BƯỚC CƠ BẢN ĐỂ THỰC THI :D
MỞ ĐẦU CHALL LÀ FORM KHÁ QUEN THUỘC , ĐỪNG AI DẠI DỘT FUZZ VÀO CÁI FORM NÀY NHÉ :D . CHUYỂN QUA TRANG "SEARCH" ĐI !
Thứ Tư, 2 tháng 10, 2019
[WRITEUP] SQL INJECTION - STRING ROOTME
[picoCTF2019][WEB EXPLOITATION] WRITE-UP !
Đăng ký:
Bài đăng (Atom)
Phổ Biến
-
SO , THIS IS VERY FIRST TIME MY NEW TEAM TAKE PART IN A CTF COMPETITION [PICOCTF] I MAKE THIS WRITE-UP AS THE NOTE FOR ALL WEB-CHALLEN...