NahamCon CTF 2023: Web Challenge Walkthroughs

[@damnqais4478]

great writeups, for Obligatory i did |{{config}}| and got the flask session secret and changed the id from 2 to 1 (admin) and got the flag in the to do list :)

[@_CryptoCat]

That's a great solution, love it! 🔥

[@ufuksahin7401]

amazing 🙌

[@_CryptoCat]

🙏🥰

[@LearnTermux]

Damn I was looking for it. Thanks sir.

[@_CryptoCat]

Very welcome! 💜

[@shubham_srt]

loved it

[@_CryptoCat]

🙏🥰

[@juliogallo7694]

Great videos as always. One of the top content creators in this domain. I hope this is sustainable for you because I know how much work goes into all this while still having a job + keeping up to date with new techniques + personal. Take care of yourself! Best wishes

[@_CryptoCat]

Thanks mate, appreciate that! It's definitely harder to keep up with content creation on my personal channel now, since it's my day job 😁 That's my main reason for participating in less these days. Also, if I do make videos I try to stick to a single CTF category to prevent burnout 🤞

[@f0rty7even9]

thanks for these videos. really helpful and well explained. keep doing what u're doing! much love

[@_CryptoCat]

Thanks mate! 🙏🥰

[@kartibok001]

Great work - and thanks for the ngrok - never seen that one before!!

[@_CryptoCat]

Thanks mate 😊 ngrok is amazing! The main downside is you can only use 1 connection at a time on the free version. Kind of annoying because you can't have a HTTP server and TCP server exposed at once, e.g. if you want to upload a reverse shell.. you won't have the ngrok address for the netcat listener, until after you close the HTTP server.. by which time you can't upload a reverse shell 😑

[@kartibok001]

@@_CryptoCat Just to have that transfer ability between two VMs in different places will be helpful - especially on CTFs as you highlighted :)

[@kerbalette156]

Epic vid. Cheers brah

[@_CryptoCat]

thanks mate! 👊

[@andrew99166]

awesome content, as always!! 👏🏻

[@_CryptoCat]

Thank you! 💜

[@0x157]

good video and ggs bro !

[@_CryptoCat]

cheers! 👊

[@RustysAdventures]

Thanks a lot for the video

[@_CryptoCat]

🙏🥰

[@0xhech768]

Awesome content, keept going 🎉

[@_CryptoCat]

🙏🥰

[@vivekkhandagre9274]

i love it

[@_CryptoCat]

🥰

[@astralwanderer3319]

Hey Jonah, great vid! Will there be another one for the forensic/reverse challs as well:) ...?

[@_CryptoCat]

Thanks mate! There won't anymore unfortunately, I stuck to the web category for this event. I used to try every category and make videos for each but I just don't have the time/energy these days so it's either a) do multiple categories and skip videos, or b) focus on one category and make a video 🙂

[@astralwanderer3319]

@@_CryptoCat Oh i see:/ Well, it would be fair to say that the next year's nahamcon vid should be on the rev/forensics category. What you say:) ?

[@c-t3ch]

Great video :) I like the Color-Settings of your terminal. Is this a plugin for terminator or how did you costumize it?

[@_CryptoCat]

Thanks mate! It's just a customised colour profile for the terminal, you can check it here: imgur.com/a/gCnvq8A - beware that some tools really benefit from a standard colour profile though, e.g. linpeas, so it's good to create a separate profile that you can easily swap between 🙂

[@tangiispotted]

Great Video! Just wondering, what VM are you using?

[@_CryptoCat]

Thanks! I'm using ParrotOS in this video 😊

[@BabeRyHellCat]

Could you please provide walkthroughs for the Video Intigriti CTF 2023? I'm really stuck with those challenges.

[@_CryptoCat]

Hey, I'll definitely release some walkthrough videos for intigriti 1337up live 2023, both here and on intigriti's channel 😊 First one will be "Web: bounty repo" released tomorrow.. Any challenges you'd like to see specifically?

[@tazaccking7467]

can you explain how to solve blobber and tiny-little-fibers [nahamcon CTF], as i spent so much time on them but unsuccessful in solving them

[@_CryptoCat]

I only looked at the web category for this CTF but keep an eye out on CTFtime for writeups. There isn't any there for tiny-little-fibers yet but here's blobber: ctftime.org/writeup/37281, you could also check the NahamSec discord as many people will post writeups there, but not add to CTFtime 😁

[@tazaccking7467]

@@_CryptoCat thank you very much

[@hurdadurP]

@@tazaccking7467 I think Tiny Little Fibers was just a JPG image with a lot of fluff at the end. Knowing the magic bytes of the image and the ending bytes were the way to solve it, as the flag is located at the end of the actual image. Magic bytes for start of stream are FFD8, end of stream are FFD9.

[@hurdadurP]

And following that, John Hammond gave an explanation in the discord what the intended solution was: strings -e l -n 2 tiny-little-fibers tiny = less than the default 4 characters in length little = little endian fibers = strings

[@tazaccking7467]

@@hurdadurP thanks bro got the flag, i used strings tiny-little-fiber in CTF for any information, at that time i dont know to use "-e l -n 2"

[@Daniel-pu8xh]

Great video! I think the intended way of obligatory was to leak the secret key from the flask app and forge a new cookie passing the id to 1. Once you became the admin the flag was there :-). But your way was faster 😅

[@_CryptoCat]

Cheers! The cookie forge technique is cooler imo 🙂

[@points7824]

Doy you use tmux?

[@_CryptoCat]

I use terminator: gnome-terminator.org