NahamCon CTF 2022: Web Challenge Walkthroughs

[@MantisSTS]

Another awesome video dude! Really great "writeup" of all the challenges!

[@_CryptoCat]

🙏🥰

[@migo369]

Awesome man! Really enjoy your videos, keep it up.

[@_CryptoCat]

thanks mate 💜

[@ca7986]

Amazing walkthrough

[@_CryptoCat]

ty 🙏🥰

[@jonathanhoyos8191]

I did enjoy. Keep posting more interesting CTF-Web challenges solutions :D

[@_CryptoCat]

thanks mate 🙏🥰

[@khalilbouzidi8432]

Thank you for sharing very informative, hope to see some buffer overflows

[@_CryptoCat]

Thanks mate 🥰 No pwn challs from this CTF but there's *a lot* already on the channel 😉

[@khalilbouzidi8432]

​ @CryptoCat ​ yes already did watch them (good content === new subscriber :D), i did know this channel when i was trying to do babysteps challenge, still couldn't solve it 🙃

[@_CryptoCat]

@@khalilbouzidi8432 there was a few ways to solve babysteps, i just used ret2libc which comes up a lot in CTFs although this was 32-bit, which is less common: github.com/Crypto-Cat/CTF/blob/main/ctf_events/nahamcon_22/pwn/babysteps.py

[@khalilbouzidi8432]

@@_CryptoCat I'm trying to learn more about pwn so thanks for the guidance

[@sahilpawar5152]

Man I had seen a challenge similar to the last one in some CTF but I couldn't solve it and weeks later, I forgot name of the CTF so I couldn't search for its writeup 😅. But now I found challenge similar to it. Thanks man really appreciate your efforts ❤️.

[@_CryptoCat]

thank you 🙏🥰

[@SuperSohaizai]

Just when I want to search for write ups, I found this. Perfect timing. Couldn't join the event at that time so will make use of this, thanks! Edit: was going to try dirbuster of some sort, but it is not allowed apparently, at least according to the rules

[@_CryptoCat]

Yeh, that's typically the case with CTFs, no automated tools. They normally say that due to the infrastructure though. I think it makes a lot less sense as a rule when each player has their own instance. I guess the challenges are designed to be solved without brute force though 😅

[@SuperSohaizai]

@@_CryptoCat yeah I agree with that part. Brute forcing kinda take the beauty out of it to be honest, even though it does make it harder. Not gonna lie, dirb was always on my mind when I was attempting, and have to keep reminding myself haha. Thanks again for the video!

[@_CryptoCat]

@@SuperSohaizai It really wasn't needed here, I just thought I'd include it in because it's one of the first things you'd do on a HTB machine, or in a real pentest. Knowing my luck people will do in CTF events now and get suspended for breaking rules: "😮 but I learnt it from CryptoCat?!" 🤣 Thank you! 🙏🥰

[@jorgevilla6523]

great video thanks

[@_CryptoCat]

💜

[@nuridincersaygili]

excellent! anything for babyrsa?

[@_CryptoCat]

nope! i normally avoid crypto 😁

[@vancaotran7547]

when will you have the pwnable video of nahamcon CTF ? I'm really looking forward to it

[@_CryptoCat]

never 😆 it was a great CTF but I don't have time to cover all challenges, especially when there's multiple competitions every week. I typically either: a) pick a category b) solve easy-ish challs from multiple category c) pick 1-2 hard challenges angstrom CTF video is coming later today though, containing a few pwn challs 😉

[@BaNguyen-xt9bg]

I wait for pwn sir!

[@_CryptoCat]

No pwn this time! I solved a couple of the easier ones but they were very similar to videos I've made before.

[@sudoer92]

Nice video i learned alot, did you win the ctf ?

[@_CryptoCat]

thanks mate 🥰 i definitely didnt win haha, just did a few challenges 😁

[@0xgodson119]

🤩

[@_CryptoCat]

nandri 🙏🥰

[@rehanmumtaz5972]

Can u share the presentation link?

[@_CryptoCat]

From the conference? Which presentation? I think they'll be uploaded to kzbin.info

[@rehanmumtaz5972]

@@_CryptoCat i think you open the presentation while solving hacker T's challenge... may be its of defcon i guess

[@_CryptoCat]

@@rehanmumtaz5972 oooooo I know what you mean! here it is: docs.google.com/presentation/d/1JdIjHHPsFSgLbaJcHmMkE904jmwPM4xdhEuwhy2ebvo/htmlpresent

[@rehanmumtaz5972]

@@_CryptoCat Thanks for sharing btw great explanation of these web challenges ! 💓

[@_CryptoCat]

@@rehanmumtaz5972 💜

[@kaizensky3399]

Did you forget to add Deafcon?

[@_CryptoCat]

nah haha a teammate solved it and i didn't have all that much time. I was just going to pick 1 hard chall.. then couldn't solve any and did a few web instead 😂 I struggled enough with some of the xss ones bc im a n00b 😆

[@seif-allahhomrani2169]

@@_CryptoCat it's cool that u mention ur failures and ur successes bro !!

[@tlouik]

@@_CryptoCat no, you're pro D:

[@IlmuGuru]

Auto subscribe , dont take down this vidio

[@_CryptoCat]

ty 🥰 i wasn't planning to take down the video but youtube censors be warned!! 😀

[@IlmuGuru]

@@_CryptoCat Calm down I've saved it in the gallery🤣

[@MrFontaineInc]

I definitely need to brush up on Regex. Personnel stumped me and it was so simple.

[@_CryptoCat]

that one was cool! don't see it much in ctfs 😊

[@nogoodhacker6944]

how were you able to guess the flag would be at /var/www/flag.txt on extravagant xml injection 6:12 ?? BTW awesome !

[@_CryptoCat]

thanks 🥰 3:19 it said the flag was at /var/www so just had to guess filename, either "flag" or "flag.txt" 😁