NahamCon CTF 2024.md

NahamCon CTF 2024 Write-up

CTFtime link: https://ctftime.org/event/2364

WEB

WEB - iDoor

Simple IDOR (Insecure direct object references), where camera ID encoded to sha256 hash

4fc82b26aecb47d2868c4efbe3581732a3e7cbcc6c2efb32062c08170a05eeb8 -> 11

0 -> 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

FLAG:

flag{770a058a80a9bca0a87c3e2ebe1ee9b2}

WEB - All About Robots

Check /robots.txt

/open_the_pod_bay_doors_hal_and_give_me_the_flag.html

FLAG:

flag{3f19b983c1de42bd49af1a237d7e57b9}

Warmups

Warmups - Copypasta

You know those funny Internet messages that everybody likes to copy and paste? Yeah....

Turns out they make a good Warmups CTF challenge, too!

Just copy and paste the text, you'll see the hidden flag there.

FLAG:

flag{1f68e019b29650f6e8ea15a7808f76fd}

Warmups - Uriel

Uriel was browsing the web and he saw this big long blob of text in his address bar! He was telling me about it but I don't remember everything he said... I think he mentioned something like "it happened twice?"

%25%36%36%25%36%63%25%36%31%25%36%37%25%37%62%25%33%38%25%36%35%25%36%36%25%36%35%25%36%32%25%33%36%25%33%36%25%36%31%25%33%37%25%33%31%25%33%39%25%36%32%25%33%37%25%33%35%25%36%31%25%33%34%25%36%32%25%33%37%25%36%33%25%33%36%25%33%33%25%33%34%25%36%34%25%33%38%25%33%38%25%33%35%25%33%37%25%33%38%25%33%38%25%36%34%25%36%36%25%36%33%25%37%64

This is URL ecnoded flag, try to decode 2 times

FLAG:

flag{8efeb66a719b75a4b7c634d885788dfc}

Warmups - That's Not My Base

Everyone knows about Base64, but do you know about this one?

(Remember, the flag format starts with flag{!)

F#S<YRXdP0Fd=,%J4c$Ph7XV(gF/*]%C4B<qlH+%3xGHo)\

Base92

FLAG:

flag{784454a9509196a33dba242c423c057a}

Warmups - Twine

Google tells me that twine means: "strong thread or string consisting of two or more strands of hemp, cotton, or nylon twisted together."

Just read png with cat or open with text editor

FLAG:

flag{4ac54e3ba5f8f09049f3ad62403abb25}