Only a Google search for "Julian Cohen" is given as the question.
From the judge's subpage (https://ctf.isis.poly.edu/judges/), you can find the twitter account for Julian Cohen which is https://twitter.com/HockeyInJune
Now we know that his nick is HockeyInJune. By searching using the nick, you can get to his Reddit page (http://www.reddit.com/r/HockeyInJune).
Look for his posting under the CSAW CTF 2013 where he have posted a link to a website: http://deathbycats.com/
Using "dig" command in Linux, you can find the ip address of the website which will be 23.23.196.37
Accessing the IP directly on the URL will show the flag. See screenshot below:
Regards,
David Billa
"Live for Something or Die for Nothing!"
Sunday, September 22, 2013
CSAW CTF 2013 :: Bikinibonanza (150 points)
For this puzzle we are given a .net executable.
This is how it looks like when executed...
First thought: enter the correct key and hit on submit for the flag to be shown...
Lets fire up reflector to decompile this .net executable
There are several eval_?? functions when decompiled. The trick to figure out which eval_?? the statements are pointing to is to click on it in reflector, the program will direct you to the correct eval_?? function.
In one of the eval_?? function, we can see that it is doing some comparison work. The comparison might be the key to solving the puzzle. Let us copy this portion and write our own code...
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Security.Cryptography;
namespace test
{
class Program
{
static int getkey(int num2, int num1)
{
return (new int[] {
2, 3, 5, 7, 11, 13, 0x11, 0x13, 0x17, 0x1d, 0x1f, 0x25, 0x29, 0x2b, 0x2f, 0x35,
0x3b, 0x3d, 0x43, 0x47, 0x49, 0x4f, 0x53, 0x59, 0x61, 0x65, 0x67, 0x6b, 0x6d, 0x71
}[num1] ^ num2);
}
static void generate(string text1, int num1, ref string textRef1)
{
int num2 = 0;
if (0 < text1.Length)
{
do
{
char ch = text1[num2];
int num = 1;
if (1 < num1)
{
do
{
ch = Convert.ToChar(getkey(Convert.ToInt32(ch), num));
num++;
}
while (num < num1);
}
textRef1 = textRef1 + ch;
num2++;
}
while (num2 < text1.Length);
Console.WriteLine(replacing(textRef1));
Console.WriteLine(replacing(textRef1));
}
}
static string replacing(string text1)
{
byte[] bytes = Encoding.ASCII.GetBytes(text1);
return BitConverter.ToString(new MD5CryptoServiceProvider().ComputeHash(bytes)).Replace("-", "");
}
static void Main(string[] args)
{
String strB = null;
DateTime now = DateTime.Now;
string str2 = string.Format("{0}", now.Hour + 1);
string str = "NeEd_MoRe_Bawlz";
Console.WriteLine(str2);
Console.WriteLine(str);
generate(str, Convert.ToInt32(str2), ref strB);
}
}
}
This is how it looks like when executed...
First thought: enter the correct key and hit on submit for the flag to be shown...
Lets fire up reflector to decompile this .net executable
There are several eval_?? functions when decompiled. The trick to figure out which eval_?? the statements are pointing to is to click on it in reflector, the program will direct you to the correct eval_?? function.
In one of the eval_?? function, we can see that it is doing some comparison work. The comparison might be the key to solving the puzzle. Let us copy this portion and write our own code...
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Security.Cryptography;
namespace test
{
class Program
{
static int getkey(int num2, int num1)
{
return (new int[] {
2, 3, 5, 7, 11, 13, 0x11, 0x13, 0x17, 0x1d, 0x1f, 0x25, 0x29, 0x2b, 0x2f, 0x35,
0x3b, 0x3d, 0x43, 0x47, 0x49, 0x4f, 0x53, 0x59, 0x61, 0x65, 0x67, 0x6b, 0x6d, 0x71
}[num1] ^ num2);
}
static void generate(string text1, int num1, ref string textRef1)
{
int num2 = 0;
if (0 < text1.Length)
{
do
{
char ch = text1[num2];
int num = 1;
if (1 < num1)
{
do
{
ch = Convert.ToChar(getkey(Convert.ToInt32(ch), num));
num++;
}
while (num < num1);
}
textRef1 = textRef1 + ch;
num2++;
}
while (num2 < text1.Length);
Console.WriteLine(replacing(textRef1));
Console.WriteLine(replacing(textRef1));
}
}
static string replacing(string text1)
{
byte[] bytes = Encoding.ASCII.GetBytes(text1);
return BitConverter.ToString(new MD5CryptoServiceProvider().ComputeHash(bytes)).Replace("-", "");
}
static void Main(string[] args)
{
String strB = null;
DateTime now = DateTime.Now;
string str2 = string.Format("{0}", now.Hour + 1);
string str = "NeEd_MoRe_Bawlz";
Console.WriteLine(str2);
Console.WriteLine(str);
generate(str, Convert.ToInt32(str2), ref strB);
}
}
}
on executing the above code we got this BEBF06D90D6F9652476D244470C66BEC
Throw this key into the application and we get the flag!
key(0920303251BABE89911ECEAD17FEBF30)
Always lazing
NoirD3vil...
Tuesday, August 6, 2013
ebCTF 2013 :: BIN200 (200 points)
The challenge for BIN200 is to uncover the hidden file contained within the given executable.
Step 1: Load the executable (ebCTF_BIN200.exe) in OllyDbg, run it and you will be prompted by the executable for a secret key. Looking through the codes reveal the executable was generated using 'Perl2Exe' - a command line utility for converting perl scripts to exe files. An interesting keyword found within the executable is '-p2x_debug', which shall be used later.
Step 2: View the events captured by OllyDbg. In OllyDbg, go to View > Log (Alt+L). There is an entry of a DLL file dumped in the AppData Temp folder. Examination of the DLL file reveals it is packed using UPX packer. Unpack the DLL using UPX unpacker.
Step 3: Rerun the executable in OllyDbg with '-p2x_debug' as the argument and debug information will be displayed in the command prompt. It's clear now the hidden file is '_main.pl'.
Step 3: Load the unpacked DLL in IDA Pro and search for the location where the string "ISEXT_Init: filename = " will be referenced. It will be located at address 0x280AC503. After examining the flow graph from that location onwards, it is clear a different path is needed in order to dump the files to the tmp folder.
Step 4: Re-run the executable, change the instruction at address 0x280AC52E from JNZ to JZ before EIP reaches address 0x280AC503 and you will find the perl script in the tmp folder.
The secret key and the flag to this challenge will be found within the perl script.
Secret key: "Sup3RSeCr3tStuFf!"
Flag: ebctf{ededb03c7998fa751be21d1364a58600}
Flag captured! 200 points in the bag!! Yay!!!
Cheers,
Braeburn Ladny
Step 1: Load the executable (ebCTF_BIN200.exe) in OllyDbg, run it and you will be prompted by the executable for a secret key. Looking through the codes reveal the executable was generated using 'Perl2Exe' - a command line utility for converting perl scripts to exe files. An interesting keyword found within the executable is '-p2x_debug', which shall be used later.
Step 2: View the events captured by OllyDbg. In OllyDbg, go to View > Log (Alt+L). There is an entry of a DLL file dumped in the AppData Temp folder. Examination of the DLL file reveals it is packed using UPX packer. Unpack the DLL using UPX unpacker.
Example:
Address=28000000
Message=Module C:\Users\Braeburn\AppData\Local\Temp\p2xtmp-4484\p2x5123.dll
Step 3: Rerun the executable in OllyDbg with '-p2x_debug' as the argument and debug information will be displayed in the command prompt. It's clear now the hidden file is '_main.pl'.
P2X: Debug mode enabled - V090508
P2X: Expanded module filename = C:\Users\Braeburn\Downloads\ebCTF_BIN200.exe
GetTempDir: returning C:\Users\Braeburn\AppData\Local\Temp/p2xtmp-4484
ISEXT_Init: filename = p2x_stub.lib
ISEXT_Init: filename = p2x_header.pm
ISEXT_Init: filename = p2x_pre_exec_message
ISEXT_Init: filename = p2x_trial_message
ISEXT_Init: filename = p2x_exec_command
ISEXT_Init: filename = p2x_info.pm
ISEXT_Init: filename = _main.pl
ISEXT_Init: filename = P2XDLL/p2x5123.dll
P2X: ISEXT_Init done
P2X: OpenScript: C:\Users\Braeburn\Downloads\ebCTF_BIN200.exe FOUND IN PERL2EXE_STORAGE
[*] ebCTF BIN 200
No comment...
[*] What is the secret?
Step 3: Load the unpacked DLL in IDA Pro and search for the location where the string "ISEXT_Init: filename = " will be referenced. It will be located at address 0x280AC503. After examining the flow graph from that location onwards, it is clear a different path is needed in order to dump the files to the tmp folder.
Step 4: Re-run the executable, change the instruction at address 0x280AC52E from JNZ to JZ before EIP reaches address 0x280AC503 and you will find the perl script in the tmp folder.
The secret key and the flag to this challenge will be found within the perl script.
Secret key: "Sup3RSeCr3tStuFf!"
Flag: ebctf{ededb03c7998fa751be21d1364a58600}
Flag captured! 200 points in the bag!! Yay!!!
Cheers,
Braeburn Ladny
ebCTF 2013 :: BIN100 (100 points)
The challenge for BIN100 is almost identical to the teaser challenge (except this is a linux executable) so we shall not go into details on what the executable does. In summary, we need to roll out 3-1-3-3-7 with a dice. Oh yes, we need to a roll a 7 with a dice. That's awesome, isn't it?
There are two ways to tackle this challenge, either by patching with NOPS or changing the instructions from JNE to JE. With the latter, you have to throw a number that is NOT wanted at that checkpoint - on your 1st throw, you have to throw any number except 3 in order to proceed to the next checkpoint.
Step 1: Identify the conditional checks for the 5 throws to be made and patch them according.
If you prefer to patch the executable with NOPS, these are the addresses to do so:
00000F8C: 75 90
00000F8D: 4E 90
00001199: 75 90
0000119A: 4F 90
000013A7: 75 90
000013A8: 6D 90
000015AA: 0F 90
000015AB: 85 90
000015AC: 82 90
000015AD: 00 90
000015AE: 00 90
000015AF: 00 90
0000180A: 0F 90
0000180B: 85 90
0000180C: C1 90
0000180D: 00 90
0000180E: 00 90
0000180F: 00 90
If you prefer to reverse the flow at each of the 5 conditional checkpoints, these are the addresses where the instructions are to be changed:
00000F8C: 75 74
00001199: 75 74
000013A7: 75 74
000015AB: 85 84
0000180B: 85 84
Step 2: Save the executable.
Step 3: Run the executable to obtain the flag.
Flag captured! 100 points in the bag!! Yay!!!
Cheers,
Braeburn Ladny
There are two ways to tackle this challenge, either by patching with NOPS or changing the instructions from JNE to JE. With the latter, you have to throw a number that is NOT wanted at that checkpoint - on your 1st throw, you have to throw any number except 3 in order to proceed to the next checkpoint.
Step 1: Identify the conditional checks for the 5 throws to be made and patch them according.
If you prefer to patch the executable with NOPS, these are the addresses to do so:
00000F8C: 75 90
00000F8D: 4E 90
00001199: 75 90
0000119A: 4F 90
000013A7: 75 90
000013A8: 6D 90
000015AA: 0F 90
000015AB: 85 90
000015AC: 82 90
000015AD: 00 90
000015AE: 00 90
000015AF: 00 90
0000180A: 0F 90
0000180B: 85 90
0000180C: C1 90
0000180D: 00 90
0000180E: 00 90
0000180F: 00 90
If you prefer to reverse the flow at each of the 5 conditional checkpoints, these are the addresses where the instructions are to be changed:
00000F8C: 75 74
00001199: 75 74
000013A7: 75 74
000015AB: 85 84
0000180B: 85 84
Step 2: Save the executable.
Step 3: Run the executable to obtain the flag.
Flag captured! 100 points in the bag!! Yay!!!
Cheers,
Braeburn Ladny
ebCTF 2013 :: NET100 (100 points)
The challenge for NET100 is to figure out, through the use of a pcap file, the damage that an evil hacker did to Eindbazen.
Step 1: Load the pcap file with Wireshark.
Step 2: Go to packet num 767. This is a packet containing a HTTP GET request that reveals a wget command was executed to download the payload file (rootkit.zip). The file can be saved to a working directory by looking up Wireshark HTTP object list. In Wireshark, go to File > Export > Objects > HTTP, to bring up the HTTP object list. Any attempt to unzip the zipped file (to view flag.txt) will fail as it is protected with a password.
Step 3: Go to packet num 8. Right click on the packet, select "Follow UDP Stream", "ASCII", and save the entire conversation as an ASCII file. View the saved file with your preferred text editor. The password lies between line 593 and line 609.
Step 4: Use the extracted password to retrieve flag.txt from rootkit.zip. The flag for this challenge lies within flag.txt. 100 points in the bag!! Yay!!!
Flag: ebCTF{b78dc61ce895a3856f3520e41c07b1be}
Cheers,
Braeburn Ladny
Step 1: Load the pcap file with Wireshark.
Step 2: Go to packet num 767. This is a packet containing a HTTP GET request that reveals a wget command was executed to download the payload file (rootkit.zip). The file can be saved to a working directory by looking up Wireshark HTTP object list. In Wireshark, go to File > Export > Objects > HTTP, to bring up the HTTP object list. Any attempt to unzip the zipped file (to view flag.txt) will fail as it is protected with a password.
Step 3: Go to packet num 8. Right click on the packet, select "Follow UDP Stream", "ASCII", and save the entire conversation as an ASCII file. View the saved file with your preferred text editor. The password lies between line 593 and line 609.
Step 4: Use the extracted password to retrieve flag.txt from rootkit.zip. The flag for this challenge lies within flag.txt. 100 points in the bag!! Yay!!!
Flag: ebCTF{b78dc61ce895a3856f3520e41c07b1be}
Cheers,
Braeburn Ladny
Monday, June 3, 2013
Codegate 2013 :: Misc #4 (300 points)
This was the 4th challenge under the misc category which was worth 300 points. A zipped file was provided for this challenge with the following hints:
The zipped file contained a single binary file with no extension. TrID was deployed to identify the extracted file based on its binary signature and was found to be a Adobe PDF file. The file was subsequently renamed with .pdf extension to view its contents using Adobe PDF Reader.
Only two words (! Confidential Documents !) were displayed when the PDF file was viewed with Adobe PDF Reader. More efforts were required to look further into the PDF specification which encapsulated a complete description of the fixed-layout flat document, including the text, fonts, graphics, and other information needed to display it.
The 1st key was found very easily within object 12. 1st_key(nn@LiC!oU$)
Hints for the 2nd key were discovered within object 5.
Hint #1 mentioned the 2nd key is made up of strings contained in three objects. Hint #2 stated the length of the 2nd key is 14. After scanning through the PDF specification, objects 6, 7, and 8 were found to be likely to contain text strings. The following line was amended to replace the digit 5 with 6, 7, and 8, to display contents of each of the objects in turn.
Object 6 :: PpPDdD[
Object 7 :: F_F
Object 8 :: ]ile
With the above strings concatenated, the 2nd_key was obtained! (PpPDdD[F_F]ile) strlen = 14
Careful examination of the data stream within object 11 was needed for the 3rd key. 1101 bytes of data were extracted and saved to a new binary file. The data were then uncompressed using PHP gzuncompress(), displayed, and found to be another PDF file.
PHP Script:
PDF Specification:
The next lead came from the Javascript contained within object 7. Some modifications were made to the script in order to view the alert which read “Decrypt_ME“. The cipher was then changed to “673B672B3E663C666F2B37390D362061″, a string contained within the extracted PDF specification, and the 3rd key was revealed. 3rd_key=4n4ly5i5
HTML with Javascript:
Captured the flag with the 3 keys combined! 300 points in the bag!! Yay!!!
Flag: nn@LiC!oU$_PpPDdD[F_F]ile_4n4ly5i5
Cheers,
Braeburn Ladny
The zipped file contained a single binary file with no extension. TrID was deployed to identify the extracted file based on its binary signature and was found to be a Adobe PDF file. The file was subsequently renamed with .pdf extension to view its contents using Adobe PDF Reader.

Only two words (! Confidential Documents !) were displayed when the PDF file was viewed with Adobe PDF Reader. More efforts were required to look further into the PDF specification which encapsulated a complete description of the fixed-layout flat document, including the text, fonts, graphics, and other information needed to display it.
The 1st key was found very easily within object 12. 1st_key(nn@LiC!oU$)
Hints for the 2nd key were discovered within object 5.
Hint #1 mentioned the 2nd key is made up of strings contained in three objects. Hint #2 stated the length of the 2nd key is 14. After scanning through the PDF specification, objects 6, 7, and 8 were found to be likely to contain text strings. The following line was amended to replace the digit 5 with 6, 7, and 8, to display contents of each of the objects in turn.
Object 6 :: PpPDdD[
Object 7 :: F_F
Object 8 :: ]ile
With the above strings concatenated, the 2nd_key was obtained! (PpPDdD[F_F]ile) strlen = 14
Careful examination of the data stream within object 11 was needed for the 3rd key. 1101 bytes of data were extracted and saved to a new binary file. The data were then uncompressed using PHP gzuncompress(), displayed, and found to be another PDF file.
PHP Script:
PDF Specification:
The next lead came from the Javascript contained within object 7. Some modifications were made to the script in order to view the alert which read “Decrypt_ME“. The cipher was then changed to “673B672B3E663C666F2B37390D362061″, a string contained within the extracted PDF specification, and the 3rd key was revealed. 3rd_key=4n4ly5i5
HTML with Javascript:
Captured the flag with the 3 keys combined! 300 points in the bag!! Yay!!!
Flag: nn@LiC!oU$_PpPDdD[F_F]ile_4n4ly5i5
Cheers,
Braeburn Ladny
Codegate 2013 :: Misc #3 (200 points)
The 3rd challenge under the Misc category, with a reward of 200 points, got underway with a binary that was identified as a “Wireshark PCAP Next Generation Dump File Format (Little Endian)” file by TrID.
2 hints were given for this challenge:
Sample list of files exported:
When the above selected file was viewed in Adobe PDF Reader, it showed the official rules for Codegate YUT Challenge. However on closer examination in notepad, the PDF specification revealed the file had several incremental updates contained therein, evident by the presence of several “%%EOF” and updated objects content. The key was revealed after the last update was deleted from the PDF specification. Flag captured! 200 points in the bag!! Yay!!!
Cheers,
Braeburn Ladny
2 hints were given for this challenge:
- [Misc3(200) Hint] You can solve the question off-line.
- [Misc3(200) Hint] Find out document.
Sample list of files exported:

When the above selected file was viewed in Adobe PDF Reader, it showed the official rules for Codegate YUT Challenge. However on closer examination in notepad, the PDF specification revealed the file had several incremental updates contained therein, evident by the presence of several “%%EOF” and updated objects content. The key was revealed after the last update was deleted from the PDF specification. Flag captured! 200 points in the bag!! Yay!!!

Cheers,
Braeburn Ladny
Codegate 2013 :: Misc #2 (200 points)
This was the second challenge under the misc category which was worth 200 points. Two files were provided, an encoded key and a source php file. The challenge was to write a decoder function to decode the encoded key.
Contents of source.php:
Several points were gathered from the encoder function:
Flag captured! 200 points in the bag!! Yay!!!
Cheers,
Braeburn Ladny
Contents of source.php:
Several points were gathered from the encoder function:
- $enc_tab, an array, comprised of 91 items.
- $var1 contained the (shifted) ASCII value of the input character being processed.
- $var2 contained the number of bits to be processed.
- $var3 contained the working value of $var1.
- If $var1 was between 89 and 8191, and $var2 was more than 13, its value would be shifted right by 13 places, otherwise its value would be shifted right by 14 places. 2 characters would be picked from $enc_tab based on the quotient and remainder from the division operation.
Flag captured! 200 points in the bag!! Yay!!!

Cheers,
Braeburn Ladny
Codegate 2013 :: Web #5 (500 points)
This was the fifth challenge under the web category which was worth 500 points. The challenge kicked off with a note that read “connect with mobile”. Connecting to the website with a stock desktop browser showed the following “mobile only” text.
In came the User Agent Switcher browser extension that switched the user agent to “iPhone 4″, deceived this restriction and gained access to the site. Oh yea!
The site was actually a game simulator where you could create your own character by giving it a name. Each character started off with 150 points to be assigned to its 3 attributes (strength, dexterity and intelligence) depending on your preference. I named my character “wolf”.
Examination of the source code revealed two Javascripts and one of them (main.js) contained obfuscated code.
Contents of main.js:
The obfuscated code was easily deobfuscated by http://jsbeautifier.org/ :)
Line 18 of the above code revealed how URLs for each of the 3 pages (home.html, introduce.html, get_tag.html) were formed. The magic embedded within index.php produced wonders when the script was fed with those parameters – the source code was displayed on the screen! Repeated this step for the php pages (simulator.php, simulator_ok.php) and gathered several valuable hints to this challenge.
Contents of simulator.php:
After the SQLite database file was extracted from the response, the next step was to write a script to read the contents from it. Recall from hint #3 above, memo.memo must be uncompressed in order to recover its original data.
Script to read database contents:
Key found! 500 points in the bag. Yay!
Cheers,
Braeburn Ladny

In came the User Agent Switcher browser extension that switched the user agent to “iPhone 4″, deceived this restriction and gained access to the site. Oh yea!

The site was actually a game simulator where you could create your own character by giving it a name. Each character started off with 150 points to be assigned to its 3 attributes (strength, dexterity and intelligence) depending on your preference. I named my character “wolf”.

Examination of the source code revealed two Javascripts and one of them (main.js) contained obfuscated code.
Contents of main.js:
The obfuscated code was easily deobfuscated by http://jsbeautifier.org/ :)
Line 18 of the above code revealed how URLs for each of the 3 pages (home.html, introduce.html, get_tag.html) were formed. The magic embedded within index.php produced wonders when the script was fed with those parameters – the source code was displayed on the screen! Repeated this step for the php pages (simulator.php, simulator_ok.php) and gathered several valuable hints to this challenge.
Contents of simulator.php:
- Line 15: if ($_POST['name'] == “GM”) die(“you can not view&save with ‘GM’”);
There was a restriction with using “GM” as the character name. GM probably stands for Game Master. - Line 17: $db = sqlite_open(“/var/game_db/gamesim_”.$_SESSION['scrap'].”.db”);
The path to the character database file! - Line 94: memo : <input type=’text’ name=’memo’ value=’<?php if (isset($row[0])) echo
gzuncompress($row['memo.memo']); ?>’ maxlength=32 />
Data contained within memo.memo must be uncompressed.

After the SQLite database file was extracted from the response, the next step was to write a script to read the contents from it. Recall from hint #3 above, memo.memo must be uncompressed in order to recover its original data.
Script to read database contents:
Key found! 500 points in the bag. Yay!

Cheers,
Braeburn Ladny
Codegate 2013 :: Web #3 (300 points)
This was the third challenge under the web category which was worth 300 points. The challenge began with a letter addressed to Sherlock Holmes.
The objective of this challenge was to play the role of Sherlock Holmes and to figure out who and when the person asked the hacker group to hack “Hound Co.,Ltd.”.
Examination of the site revealed there was a suspicious Javascript file secret.js which was the first lead gathered for this challenge. However the code was clearly obfuscated as shown below.
Contents of secret.js:
The obfuscated code was easily deobfuscated by http://jsbeautifier.org/ :)
Line 8 of this Javascript exposed the hidden php file, d56b699830e77ba53855679cb1d252da.php, which was revealed as a popup after the “Grey” logo was clicked for 10 times. In fact this was the login form. The challenge would be to find the login credentials to gain access to the restricted area.
Candy: md5(login) = d56b699830e77ba53855679cb1d252da
Examination of the site did not show any obvious sign of possible SQL injection flaw. Do you know of any tools that can assist you to look for such flaws?
There are several tools that can automate the process of detecting and exploiting SQL injection flaws and sqlmap, an open source penetration testing tool, is the tool widely used for this purpose.
Command used to identify time-based blind sqli with parameter “question”:
Subsequently commands were issued to identify the databases, tables and table entries:
Put the passwords through md5 decrypter to be decrypted:
Logged in with the credentials for victor and solved the mystery! 300 points in the bag. Yay!
Cheers,
Braeburn Ladny
The objective of this challenge was to play the role of Sherlock Holmes and to figure out who and when the person asked the hacker group to hack “Hound Co.,Ltd.”.
Examination of the site revealed there was a suspicious Javascript file secret.js which was the first lead gathered for this challenge. However the code was clearly obfuscated as shown below.
Contents of secret.js:
The obfuscated code was easily deobfuscated by http://jsbeautifier.org/ :)
Line 8 of this Javascript exposed the hidden php file, d56b699830e77ba53855679cb1d252da.php, which was revealed as a popup after the “Grey” logo was clicked for 10 times. In fact this was the login form. The challenge would be to find the login credentials to gain access to the restricted area.
Candy: md5(login) = d56b699830e77ba53855679cb1d252da
Examination of the site did not show any obvious sign of possible SQL injection flaw. Do you know of any tools that can assist you to look for such flaws?
There are several tools that can automate the process of detecting and exploiting SQL injection flaws and sqlmap, an open source penetration testing tool, is the tool widely used for this purpose.
Command used to identify time-based blind sqli with parameter “question”:
Subsequently commands were issued to identify the databases, tables and table entries:
Put the passwords through md5 decrypter to be decrypted:
Logged in with the credentials for victor and solved the mystery! 300 points in the bag. Yay!

Cheers,
Braeburn Ladny
Subscribe to:
Posts (Atom)
