The Security Wind

1753CTF 2025

Mon, 14 Apr 2025 14:08:14 +0000

This time I couldn’t invest a lot of time, but I still solved some easy challenges.

1753CTF 2025 was different from those I participated in the past, in a way that the interaction with the platform (submitting flags, registering, etc.) was handled through a Discord AI bot, and it was refreshing and fun.

The first two challenges use the same source code.

Escatlate (flag #1) - Web

The challenge provided a URL and the source code of index.js.

After I opened index.js, I immediately searched for the keyword flag to get an idea of what I should do.

It looks like there are two separate flags for the two different challenges.

If the user role is admin, the server will send the admin flag when accessing the /api/message endpoint. If the user role is moderator, it will send the moderator flag.

I searched for the keyword moderator and there were no other places with this keyword.

I continued reading the code, specifically the /api/register endpoint.

We can see that this function checks if the user already exists (line 85-86), validates that the role parameter in the request body is not the admin role (88-89), and then creates the user.

So it might be simple - all we have to do is register with the moderator role.

And we can access the flag.

Escatlate (flag #2) - Web

Let’s move on to retrieving the admin’s flag. We know that we need an admin role, but the registration functionality checks if we register with the administrative role:

if(req.body.role?.toLowerCase() == 'admin')

As we previously saw, the flag will be exposed only if the output of role.toUpperCase() would be ADMIN:

if(req.user.role.toUpperCase() === 'ADMIN')
 return res.json({ message: `Hi Admin! Your flag is ${process.env.ADMIN_FLAG}` });

It means that we need to find an input for the role value which will behave like this:

role.toLowerCase() == 'admin' //false
role.toUpperCase() === 'ADMIN' //true

And the solution for this is to use a character that looks like i instead of the i in admin (Unicode normalization), for example Latin Small Letter Dotless I:

We can see that it should work:

And here’s the PoC:

Entropyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy - Web/Crypto

Description: It’s finally here. Something everyone’s been waiting for. A service that solves the biggest problem of humanity. People passwords. They are tooooooooooo short.

We got a PHP app. By looking at the code (specifically the long entropy and the use of Bcrypt), I knew the solution right away.

We can see that the password is hashed using bcrypt and is generated by the combination of username, entropy and password.

A few months ago, I read an article about a potential issue with bcrypt, which was discovered in Okta (but of course relevant to other applications too).

Bcrypt only uses the first 72 characters for the hash.

As we said, the hash is derived from the username, entropy and password:

$hash = password_hash($usernameAdmin . $entropy . $passwordAdmin, PASSWORD_BCRYPT);

The username is Admin which is 5 chars and the entropy length is 66 chars. Both of them are 71 chars long. The 72nd character is the first character of the password, which means it ignores all the rest of the password. So we only need to guess the first character of the password.

Happy Hacking,
Orel 🌏

Small Winds - No. 07

Mon, 07 Apr 2025 01:41:58 +0000

A personal mini blog about infosec and life

It’s been a while since I posted. Here’s what I’ve been up to.

Thoughts and Experiences

(🐞) My bug bounty plans have been changed. Inspired by Ciarán, I made myself a challenge (60 hours challenge). I chose a target site and I’ll see how things progress. My expectations are not very high because the scope of the program is quite small, but let’s see how it goes! Oh, and actually this mini blog series is also inspired by his blog.

I’m already 5 hours in and mainly used it to set automations for this website. Specifically, monitoring changes in JS files. I’m not done with it and wonder if it’s worth my time, since the JS files are very obfuscated, large (1-2 MB), and the obfuscation changes about every day. One thing I could do, is to monitor for changes, prettify the files, check for new or removed lines (while ignoring lines that were modified, as it modifies the obfuscated variable names - I take into account the possibility of missing stuff), and keep only the new lines.

This program isn’t new to me and there are things I’ve already done. So here are the recent highlights including other stuff.

(🗒️🗒️🗒️) Organized and gathered my notes and leads. I exported the relevant things from Burp Suite to Caido.
(🪲) I found a bug in my target site that exposes PII, but it was a duplicate.
(🔍) I started using Caido. Although it lacks some of the features Burp Suite provides, it has other nice features, like workflows, findings, files and other interesting sections. They make it better frequently. I also really like the UI and the fact that it works very fast. I’m really afraid it would be emotionally hard for me to get back to Burp Suite if I have to.
(🪲) I tested a certain feature in a website I use, for personal reasons and it led to a bug. I reported it and it was considered informative. This will probably be my next target site for my next challenge, after I finish this one.
(👩🏻‍💻👩🏾‍💻👨‍💻👨🏻‍💻👨🏾‍💻) Critical Thinking had another hackalong event which was fun and beneficial. I continued testing this target with the leads I gathered during the event.
(👩🏻‍💻👩🏾‍💻👨‍💻👨🏻‍💻👨🏾‍💻) Critical Thinking also had a bug escalation event where people shared some unbaked bugs and we tried to exploit them together. It was funny and informative.
(📱) There’s a certain mobile app I use on a daily basis, and it motivated me to do some Android mobile hacking, so in my spare time I focus on this. I think this is one of the reasons I commonly encounter the advice of doing bug bounty of apps you already use, or apps that interest you. Personally, I have more motivation there.
(📝🎫) A while ago, I spent a lot of time in doing threat modeling on the application I test, organizing everything and reading the documentation. Although it took a lot of time, it was beneficial and important. It made me understand the application much better and the testing much more efficient. Specifically, reading the documentation resulted in the discovery of new attack surfaces and ideas and also valid coupon/invitation codes, email addresses and usernames I can use for testing. It was kind of funny that they accidentally exposed an invitation link in a video when hovering over a link.
(⚙️) I used gau for the target site, and it revealed a lot of useful URLs - some of them contain credentials and even valid coupons or invitation links. This is a very powerful tool.
(🐞) Found a bug in BMW that got accepted: https://app.intigriti.com/profile/orelg

Interesting Resources:

https://regexper.com/ - website that shows regex using a diagram.
https://portswigger.net/research/top-10-web-hacking-techniques-of-2024-nominations-open - all the 2024 nominations for the top 10 web hacking techniques.
https://medium.com/@illoyscizceneghposter/exposed-credentials-guide-not-just-in-client-javascripts-101-case-studies-131b765e07a2 - niche areas for exposed credentials.
https://medium.com/@maxpasqua/type-confusion-dos-in-fb4a-747837d3a8e3 - Type Confusion in Facebook.

Small Winds - No. 06

Fri, 20 Dec 2024 17:45:17 +0000

A personal mini blog about infosec and life

One day, about two weeks ago, my partner was talking to me, and I felt the urge to pay closer attention as he spoke. I focused on his body language, facial expressions, and other nonverbal cues, knowing that by doing so, I could better understand his feelings, what he really tried to tell me, and connect with him on a deeper level. I’m not sure what made me do this, but I believe that many times people speak to me (and I’m sure I’m not the only one), and although I’m usually attentive to their words and emotions, placing even more focus on the person I’m communicating with can yield much more from the conversation. A while ago I started reading a certain book (maybe I’ll review it once I’ve finished reading it) that touches on this topic in one way or another. Years ago, I got familiar with the concept of active listening, so this subject wasn’t new to me. Still, I want to be more conscious of it as it truly enrich relationships, and I really encourage others to get familiar with it as it can enrich yours as well.

Recent Thoughts and Experiences

(🤩) My last CTF writeup was shared in two different blogs, wow! That really surprised me.

I also won the ‘Most Detailed Writeup’ competition for the World Wide CTF! It was for this writeup. I didn’t even know about this competition when I wrote it.

(🔬) Someone (I believe it was James Kettle) mentioned in the past something about how a person could start research. More specifically, he mentioned an article that I want to find. He talked about people sometimes asking which subject they should research and whether their research ideas are good enough. I remember him saying that if you have an idea for research, just go for it, there are no bad ideas for research (I hope I’m not misquoting him 😬). Either way, I believe in that approach, and I’ve been waiting for interesting ideas for things I’d like to research. Recently, in one of my tests, I encountered two strange behaviors related to servers or reverse proxies. One of them involves a discrepancy related to encoding, and the other is related to a certain malformed HTTP request structure and the behavior of servers and reverse proxies to that.

(🚩) Last weekend I participated in a certain CTF and tried a certain challenge that taught me a few things but in overall it was a guessy challenge. A guessy challenge refers to one that lacks clear direction, includes red herrings, and requires guessing unrelated to logical reasoning.

Generally, I believe these kinds of challenges are considered less favorable because they waste the solvers’ time on parts that might be irrelevant to their solving attempts.

For example, you can see the following comments from people about such challenges:

Here are a few points that can be problematic in challenges:

Participants have to guess things unrelated to logic (for example, a username, or even worse - one that isn’t found in common wordlists).
No source code is provided, the web application has many functionalities, and nothing appears suspicious or everything returns 500 errors.
A challenge that provides source code, which is not the real source code, with parts of it removed.
Suspicious behaviors or even vulnerabilities in the web application that are unrelated to the solution.

There are more aspects that can decrease the quality of a challenge, such as copied challenges from other CTFs, wrong flags, etc., but this section is about something else.

(🔎🐛) I haven’t invested enough time in bug bounty lately because of the many tasks I have, and since I sometimes feel very tired after work, I’ll try to lower my weekly goals to 5 hours a week and see how it goes from there. I’ll update each time on how my goal progresses, and I’ll start with one month.

I haven’t mentioned it, but my main goal in bug bounty is to get better at application security. Sometimes, I encounter the belief that after a certain amount of time—let’s say one to three years—there’s a feeling that a person has reached a level beyond which there isn’t much more to learn. However, when I encounter bugs, ideas, exploitation methods, a deep understanding of certain technologies, programming skills, and more, I see how much more room there is for improvement and learning.

My second goal is to hopefully earn money from this.

(🚩) This year, I’ve reached the goal I set for myself two and a half years ago regarding CTFs. I find CTFs to be another way for improvement. If previously I focused on getting the highest score, currently I invest a certain amount of hours each weekend on a specific challenge or challenges, and focus on learning and research. This means that I still try to solve the challenge, but I delve deeper into things like documentation, deeply understanding the source code, researching topics, and trying to comprehend and learn, even if it comes at the cost of not solving the challenge in time. Actually, a lot of times the opposite is true - focusing and investing time on understanding the system and researching helps with solving the challenge.

(🤖) XBOW - In the past months, there have been talks about XBOW, which is supposed to be an AI-based tool that helps with penetration testing and bug bounty. The company claims that the tool’s capabilities are very powerful, for example, you can see some of them here. Since September, they’ve reached the #11 place in the USA on HackerOne and found 20 critical bugs. Although some of the programs may have been VDPs, it still raises questions such as: How will this tool or other ones in the future affect bug bounty hunters and programs? How will it affect penetration testers’ job positions? Is it really as good as they claim? Which bug types can it find?

People say various things, and I agree with some of them. If it’s as good as they claim, it may be beneficial to the security research field as it will give penetration testers and bug bounty hunters more time for research instead of investing time in finding basic vulnerabilities.

It may also drive people to get even better and search for even more complex bugs.

Time will tell.

(📄) As time passes, my belief that Mirantis will help me with the voucher problem for the DCA exam disappears. I believe I’ve studied enough to pass it, but I’m not planning on paying another ~$200 for a voucher :)

I’ll try contacting them a few more times, but maybe I’ll leave it in the near future. I’ve gained the knowledge and experience I wanted.

Now I’m thinking about my next certification, and it will probably be one of the AWS ones as I want to study cloud security.

Regarding my studies for the DCA exam, in the last few months I’ve noticed how my control and understanding of Docker have increased. I’ve used Docker for creating images that helped me with tasks at work and when docker files were provided in CTFs. Now I’ve also started using it for personal labs and mini-projects or poc’s I need.

(🐛🐛🐛) This week I participated in an online Hack-Along event for a certain bug bounty program. I partially participated but my main goal is to also see how others hack, while Rhynorater was streaming. Although there were some similarities of things I do, I learned a few things and got some new ideas. I need to strengthen my client-side hacking and I might give Caido a try in the future. Two people even found vulnerabilities, one of them found a few critical ones.

Interesting Resources

https://github.com/assetnote/nowafpls - Documented WAF limitations that can help with bypassing WAFs.
https://blittle.github.io/chrome-dev-tools/ - Dev Tools tips. I haven’t tried it yet, but checked it out and I totally plan to.
https://xsinator.com/testing.html# - XS leak tests for browsers.

Small Winds - No. 05

Mon, 02 Dec 2024 21:28:42 +0000

A personal mini blog about infosec and life

Recently, I took the chance to better get to know the city I live in and went for a long walk (also for exercise). I got familiar with other parts of the city I hadn’t known. I realized there was a large area with many stores but almost no people or cars. It felt like an abandoned city, especially because it was maintained and clean. It was very strange to experience that, it was almost like a dream. Also, in another area there was a disproportionately huge residential building (its proportions could hardly be grasped from this image). It actually reminded me of the buildings and atmosphere from Little Nightmares II.

Monthly Thoughts and Experiences

(📗) I finished reading the book “Real-World Bug Hunting: A Field Guide to Web Hacking”. It was published in 2019. The book is structured so that in the beginning there is a brief explanation of web concepts and the HTTP protocol. Later it goes through different vulnerability types. There’s an explanation for each type, and then the author shows different bug reports and explains each of them from the easiest to the most difficult while providing takeaways for each one (I really liked the takeaways).

It also provides some tips related to bug bounty in general.

I was already familiar with a great part of the book but I learned some good tips and new techniques I wasn’t familiar with. It was also nice to refresh my knowledge. Throughout the book I took notes (created some kind of checklist) of interesting techniques I want to check in the future.

The book was written very clear and was structured in a thoughtful and smart way. I would suggest it to beginners and also to intermediate-advanced level bug hunters, researchers and penetration testers who want to refresh their knowledge and maybe learn some new things. I’d give it ⭐⭐⭐⭐⭐ (out of five).

(🐛) I still haven’t heard from the vendor who has a high/critical vulnerability in their software. I also haven’t yet received a CVE number or reply from MITRE and I’m not sure if there is a technical issue that causes that. I’ll try getting help from CERT, and hopefully it will bear fruit.

I found a company that has a bug bounty program that is vulnerable to this, so meanwhile I reported this issue to them.

I was also added to the Israeli VDP reporters table for reporting an LFD vulnerability I previously mentioned.

(🔎🐛) Although I tried in the past, I have started investing time in doing bug bounty. Currently, I aim to invest about 7-8 hours per week (although it doesn’t feel enough, especially when there are open leads and everyone can report potential bugs instead of you). I already found some things that look like potential bugs.

I also joined the ‘Critical Thinking’ Discord server (actually, I joined it long ago but just started to be more active). It’s the Discord server of the ‘Critical Thinking’ podcast. There are interesting discussions about web app vulnerabilities and bug hunting.

(🦫) I learned a bit about Go when trying to solve a CTF challenge. I focused on learning while solving this challenge, so I invested time in understanding different things I encountered in the web application source code and in things related to the Go templating engine. I also noticed again that by writing a writeup, because I have to explain my solution, some questions arise that I don’t have answers to right away so I have to learn and understand more, which makes me study it more deeply.

(🏟) I went to the INTENT conference, mainly for participating in the CTF (although I could probably do that remotely). There were two web challenges. I tried one that was written in Ruby. I haven’t solved it, but the challenge was about accessing an administrative page only accessible using a session that includes the admin’s email address. I believed that the vulnerability was the discrepancy between the login process and the registration process which used the Mail gem. I wanted to find a way that I could register with one email address and when I log in, it would be parsed as another email address. Since it was the last minutes of the CTF, I didn’t find a way to do that. However, a few days ago I read this article https://portswigger.net/research/splitting-the-email-atom and I knew it had something to do with it, but when I read this part, I was even more confident about it.

Maybe I’ll later run the challenge in Docker and write a writeup about it. Either way it was worth it since I made some new friends after going to the conference.

(🐋) I wanted to take the DCA exam but because of an issue on the website of the company that manages the exams, the voucher I purchased was canceled. I tried to contact Examity and Mirantis but it seems that both companies don’t want to help with this issue. I’ll try contacting Mirantis a few more times, and hopefully I’ll receive an answer.

(🎄) The annual THM Advent of Cyber 2024 has started and I’ll give it a shot, it has nice prizes.

Cool Articles

World Wide CTF 2024 - World Wide Email Search (Web)

Sun, 01 Dec 2024 12:15:51 +0000

I think this was the first time I was part of one of the first teams to solve a hard challenge in a big CTF. We were the third team to solve it (it ended with 7 solves out of ~580 teams). Sagiv and I worked together on this challenge and it was enriching and fun, especially because I tried a lot of different things along the way and learned new things.

The solution to this challenge might seem a bit straightforward or easy but I think what made it a hard challenge were the subtle hints and limited suspicious behaviors, which affected the leads.

So instead of writing a concise writeup, I’ll explain how we got there.

If you want a TL;DR, click here => teleport me

After entering the URL we see that we can enter an email address and could probably retrieve the results for that email address.

I wanted to understand what technology is in use, but didn’t see any indications of that, so I used the 404 error message to understand what the technology might be.

According to this useful article, the web app is probably written in Python, using Flask.

Back to the main functionality. Searching for a certain email address results in these messages.

Two different messages - interesting. Maybe it indicates something?

An invalid email format results in this error and it doesn’t reflect the input. Also, interesting - why wouldn’t it reflect the input?

We tried to understand the web application’s behavior, fuzzed a little bit, and tried different injections, which didn’t work.

The web application removed the following characters from the input:

'
"
\
some whitespace characters

At this point we had a few ideas:

SSTI using the reflection of the email address. Although it reflected inputs like {{7*7}}@gmail.com without evaluating them, we wondered if we needed to enter an input that would be both a valid template and a valid email format from start to end.
We wondered if we should find the correct email address to retrieve the flag. If so, maybe NoSQL injection or blind SQL injection could help with that.
Some of the email addresses were reflected in the server’s response while others were decoded:
Maybe there’s a system command on the backend that is used and we can exploit it to perform command injection?

Right before continuing, one of the first things that came to my mind was a research article by Gareth that I had wanted to read for some time now, and I thought it might be related (I** highly** recommend reading it). Most of it talks about how various valid unpopular email formats can be valid email addresses, while they might cause security issues.

We thought about whether we could enter an input that would be considered a valid email format but would later be parsed as something different which could help us with our leads. Unfortunately nothing worked. HOWEVER, one of the things that Gareth mentioned was Unicode overflows.

I tried that and it didn’t work. I’m not sure if it’s because it works differently in Python or because of another reason. But I tried to copy the weird ’l’ characters (I tried the other ones as well) and it turned it to a normal ’l'.

I know this Python’s behavior. It’s Unicode normalization. Sometimes it can be used to bypass blacklists when trying to bypass sandboxes or maybe with when trying to exploit SSTI too.

We tried a few things and then we’ve thought - “wait, if we can turn characters to other ones like к to k, can we do that for other characters? For example for a single quote?

We got some ideas from perplexity:

Note that the first character is not a backtick which didn’t work for this challenge.

Eventually, we had a lead! The left single quotation mark was reflected as a single quote in the first message and resulted in a syntax error in the second message.

Perplexity, do your magic.

So it’s SQLite. From here, the solution might be pretty straightforward.

Just to make sure.

Table structure (we replaced spaces with /**/).

And here’s the flag.

TL;DR:

The user enters an email address.
The web application only supposedly allows a valid email format, and removes single quotes, double quotes and whitespaces from the input.
Python has Unicode normalization, so it turns the left single quotation mark into a single quote.
Using that, it’s possible to use this and /**/ as a substitute for whitespace to craft an SQL injection payload to retrieve the flag. You can find the payload above.

Feel free to message me if you think there are any inaccuracies in the article.

Happy Hacking,
Orel 📧

4T$ CTF 2024 - My Sky Blog

Sun, 10 Nov 2024 18:00:44 +0000

This CTF challenge was mainly about SSTI in Go. There were various functionalities, and I’m not sure if all of them were necessary, so I’ll focus only on the ones relevant to this solution. Although there weren’t many solves, this challenge wasn’t hard and I liked it because it helped me learn more about Go and how SSTI works in Go.

Source code provided at the end of the article.

The web application is some kind of blog that lets us register, view and create blog posts.

As we can see, it’s a Go application. There are different files for the different functionalities. Here we can see the web application’s routes.

As always, one of the first things I do is to understand what is probably required for retrieving the flag. So let’s see what the ‘flag’ function does.

As we can see (line 45), it checks if we are an admin user. If we are, the server returns the flag.

I checked a couple of things but then I saw on the CTF Discord server that there was an issue with this challenge and the creator sent the changes made in the code.

According to this, the solution should be related to something in the ‘index.go’ file.

In the old (and secure) code they rendered the template using {{.User.Username}} as the username of the logged in user. The username in this case will be safely displayed without evaluating the value within it (when the username value is an SSTI payload).

The new and insecure version takes the username itself, appends it to the random sentence (to one of the sentences in lines 13-16) and then renders the template.

Let’s say the username is {{html “Orel”}}, it will look like this in secure code vs. insecure code:

Secure code before rendering:

Hey, {{.User.Username}}; there are {{.NbPosts}} posts right now !

Secure code after rendering:

Hey, {{html "Orel"}}; there are 1 posts right now !

Insecure code before rendering:

Hey, {{html "Orel"}}; there are 1 posts right now !

Insecure code after rendering:

Hey, Orel; there are 1 posts right now !

In Go, as far as I understand, SSTI is restricted in a way that we can only access exported (public) struct fields and methods passed to the template. Line 35 tells us that ’s’ is passed to it, which is the Session struct (line 20).

So let’s see what fields we can access in the Session struct. Remember that our goal is to access ‘/flag’ using an admin account.

‘User’ refers to our account, nothing interesting there. But let’s see what’s in the ‘Post’ struct.

‘Author’ looks interesting, it’s a pointer to the ‘User’ struct.

Every user has access to a post that has the admin user as the ‘Author’ field.

Our payload would begin with {{ (index .Posts 0).Author }} which is the admin’s User object.

Currently the payload is combined from Session > Posts (Post struct) > Author (User struct) > ?.

Let’s see what fields or methods we can access in the ‘User’ struct. The ‘ChangePassword’ method looks interesting.

Let’s form our payload and try it:

{{ ((index .Posts 0).Author).ChangePassword "NewPass" }}

Registration with the SSTI payload as the username:

Log in so the web application will render the template with the username. Note that it evaluated the template action (expression) and shows ’true’ as the rendered value.

We can log in with the new admin credentials and access the flag.

Source code: https://gitlab.com/4ts/ctf-2024/web/sky-blog/-/tree/main/src?ref_type=heads

Happy Hacking,
Orel 🌧

Small Winds - No. 04

Mon, 14 Oct 2024 21:23:22 +0000

A personal mini blog about infosec and life

Recently, YouTube reminded me of a piece I used to listen to: https://www.youtube.com/watch?v=2zcTKhohtJg.

This video includes the Minuet and Badinerie movements of Bach’s Suite No. 2 in B minor. I became familiar with these pieces, specifically the Badinerie from the old 1993 “Bonus” PC game I played when I was younger. It turns out that my partner knows this game as well, so it was nostalgic and fun.

(🎮) I also play Little Nightmares II. It’s a game where the character is small (young?) and weak, in a world full of nightmares and finds another little companion along the journey. I’ve never encountered a game in this genre with graphics, puzzles, and surroundings as creative and unique as this one (or maybe I just don’t play a lot 🙃). They have surely succeeded in delivering the feeling of being weak and vulnerable in a world full of threats and surprises, along with self-belief and the feeling of being able to survive.

(🎥) Additionally, randomly chosen, I watched the South Korean sci-fi TV series The Silent Sea which is one of the best TV series I’ve ever watched.

New Things I learned

(🔬) EJS is a templating engine usually used with Node.js. When used with Express, EJS can be susceptible to SSTI vulnerability when we can control the template rendering process. Since Express.js enables extended query string parsing by default (e.g. filter[status]=active&filter[age][gte]=30), it allows us to control the options passed to EJS render() function.
(🔬) A cool blog post about a vulnerability chain involving Clickjacking that led to $4133.7 from Google. It was nice to see the process of exploitation and the persistence when things didn’t work as expected: https://x.com/rebane2001/status/1836653696639271329
(🔬🐍) In Python, if we can send a string that will be formatted or control the format template, we can execute arbitrary code and read internal data. Two examples:
(🔬💉🛢️) If there is a nosql injection in MongoDB and it uses aggregation, we can interact with data from other collections. We can use ‘$lookup’ and ‘$unionWith’. How can we know there is aggregation when there is no source code? As mentioned in the article in the references: “In MongoDB, the aggregate method always expects an array of aggregation stages as its first argument. Therefore, look for JSON arrays as a parameter. The “$match” and “$lookup” operators in a JSON request can also indicate the use of the aggregate method”. References:
(📗) I didn’t think about it before, but I learned from the book “Real-World Bug Hunting” that even if HttpOnly attribute is set, in situations where there is XSS and also misconfiguration such as /phpinfo.php (which reflects the cookies) we can steal them anyway.

Weekly Thoughts and Updates

(📄) My first CVE was published 🎉 https://www.cve.org/CVERecord?id=CVE-2024-44807
(📄) Handling the CVE process because of this CVE publication (and because of another one I really wish to publish), made me think about going through various random CVEs. Since they usually have public references (as part of the requirement for CVE publication), I can read, learn from them and gain inspiration for vulnerabilities.
(🐛) A week ago I contacted the vendor of the product I found a high-critical vulnerability in, but still no reply from them, I’ll wait another week and contact them again. Meanwhile I’m trying to see if any of the vulnerable companies using this product has VDP or BPP.
(🐋) I’ve finished the Docker course and now I’m preparing for the certification test.
(🔨) Got an idea for a tool that identifies the framework/programming language/etc. of web apps using different methods. I put it in my To Do/backlog list, and I will later check this idea..

BuckeyeCTF 2024 - quotes (Web)

Mon, 30 Sep 2024 05:19:04 +0000

Unfortunately, I did not have much time to try more challenges so this will be a short one.

The challenge provided the URL for the web app and its source code (can be downloaded at the end of this article).

When I accessed the URL, the web app displayed this message:

The source code contained these files:

After searching for the flag’s location, I noticed it is the 8th quote in the ‘quotes’ file.

Let’s check the ‘app.js’ file to understand how to retrieve it.

By sending a GET request to ‘/register’ we can generate a JWT:

The web app reads the contents of the ‘quotes’ file, and splits it into an array of strings, where each element represents a single quote:

There are some other functionalities in the web app, but after reviewing the code and thinking they might be irrelevant, I focused on this part:

By sending a GET request to ‘/quote’ with the ‘id’ parameter which is the quote id, we might somehow retrieve the flag.

Let’s break this code:

line 66: Number() converts ‘id’ to a number (i).

line 68-72: checks if ‘i’ is equal to or greater than FREE_TIER_QUOTE_LIMIT (which is 5. I did not add this code section).

It means that it prevents us from retrieving the flag which is the 8th quote (index ‘7’).

line 74-78: checks if ‘i’ is in the array bounds.

line 80-85: applies parseInt() on ‘i’, and will display the corresponding quote depending on the result (for example, 5 will show the quote in index ‘5’).

I knew that parseInt() has certain behaviors that might be related to the vulnerability. It reminded me of a challenge I had solved before, but this time it was a bit different: https://www.thesecuritywind.com/post/uoftctf-2024-writeups#viewer-qdfm150837

In summary:

We provide an ‘id’ value.
The ‘id’ is converted to a number (‘i’).
parseInt(i) parses the input until it encounters a non-digit character. For example ‘1b2’ will be parsed as ‘1’.

So I searched for a value that is considered a number, remains unchanged after the Number() function, but will be parsed as ‘7’ after the parseInt() function.

Note: In retrospect, I realized that there are valid values which can change when passed to the Number() function.

I tried some values and fuzzed a little bit. All of my attempts resulted in quotes I was permitted to read, ’null’ or errors.

Then I found a certain number representation that could work for our conditions (different representations can be found here: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number).

Number(“7e-310”) is converted to 7e-310.

7e-310 is between 0 and 7 (7*10^-310 is a positive number close to 0).

parseInt(7e-310) is 7.

It works because JavaScript represents very small numbers using scientific notation. For example, while ‘0.000007’ is represented as ‘0.000007’, ‘0.0000007’ is represented as ‘7e-7’.

So even if we send an id of ‘0.0000007’, it should work as well since Number(“0.0000007”) will convert it to ‘7e-7’ and parseInt() will parse it as ‘7’.

Source code:

Happy Hacking,
Orel 🐠

PatriotCTF 2024 - Open Seasame (Web)

Mon, 23 Sep 2024 17:10:51 +0000

The challenge provided two files - server.py and admin.js, and a link to a web application that lets us enter a URL path that the bot will visit, which means this challenge is probably XSS or SSRF-related.

Let’s dive into the source code and see where the flag is mentioned, so we can think about the next steps.

Unfortunately, I did not find any mentions of a flag, but we can see in ‘server.py’ that a secret value is read from ‘secret.txt’.

Later in the code, we can see that this secret value needs to be set in the cookies for the ‘/api/cal’ API endpoint. We can also see that it is probably possible to exploit a command injection vulnerability, using the ‘modifier’ parameter. It would look something like:

?modifier=;ls

Maybe we can tell the bot to visit this API endpoint if the bot has the secret in its cookies, and somehow send us the command injection results.

Looking at the ‘admin.js’ file, we can see that the bot has the secret in its cookies, but we cannot tell it to visit any URLs that include ‘cal’ or ‘%’.

So we need to find another way to make the bot access the API endpoint vulnerable to the command injection.

We can add a high score in the system by sending ‘username’ and ‘high_score’ parameters and we will receive a UUID.

And this API endpoint returns the high score UUID data.

This is the main functionality of the web app. We need to retrieve the secret value to be able to exploit the command injection, or to make the bot access it.

We can try to inject a script as the ‘username’ parameter’s value in the ‘/api/stats’ endpoint and then, tell the bot to visit the UUID that contains the XSS payload.

Injecting a script in the ‘username’ parameter’s value:

The script tells the bot to access ‘/api/cal/?modifier=;cat secret.txt’ (the endpoint vulnerable to command injection), and to read the content of the ‘secret.txt’ file. Then it will create a new Image object with the source of our server, and appends the response of the ‘/api/cal’ request a parameter’s value.

An image object was used instead of XHR or fetch() requests to bypass the same-origin policy requirements which are not applied to images (I’m actually not sure why it blocked the requests in my initial attempts using fetch(), as they were GET requests without any special headers, but I didn’t delve into this, and I just replaced it with an Image object).

This is how the bot probably see it:

Telling to bot to visit this UUID:

The bot request to our server which includes the contents of ‘secret.txt’ file:

Using the secret to find the flag file and read it:

Happy Hacking,
Orel 🍊

Small Winds - No. 03

Tue, 10 Sep 2024 18:37:05 +0000

A personal mini blog about infosec and life

Previously, I mentioned my interest in improving my knowledge of browser internals and application security.

Although I am working on this in the background (and probably should invest more time in it), I also know it is crucial for me to strengthen my skills in cloud-native technologies and cloud platform security. So I have started studying for the Docker Certified Associate certification (https://github.com/Evalle/DCA). I will probably finish it by the start of next month.

Weekly Thoughts and Updates

Comparing Link Finder Tools

I compared the results of ‘JS Link Finder’, ‘LinkFinder’, and ‘JS Miner’.
Personally, when full coverage isn’t very important, I would prefer using ‘JS Link Finder’ and ‘JS Miner’, as almost all the time the first two tools found the same things, while ‘JS Link Finder’ performed a bit better.

Comparing Tools to Potentially Finding a CVE

While doing this comparison, I found an interesting URL path that led to some kind of administrative feature that potentially allows me to add and remove servers, view IPs, ports, names, and maybe other things as well.

As a coincidence, last weekend I tried a certain CTF challenge (SnakeCTF - Affekot) that was related to this topic. The web application used Next.js, and one of the URL paths was a page for developers to register an admin user. After that, it was easy to get the flag.

Web Timing Attacks

I’ve finished James Kettle’s article about timing attacks, and it was super interesting. This issue or type of attack is probably relevant to a huge amount of web applications, much like how SQL injection was very common years ago.

Link: https://portswigger.net/research/listen-to-the-whispers-web-timing-attacks-that-actually-work

A Few Other Notes

I had the chance to gain some experience with a Java Spring environment, so I learned a few new things about it, which was pretty fun.
I received a CVE number for the vulnerability I mentioned in the past. The next step is to contact the vendor.
I haven’t heard anything new about the LFD vulnerability I found and sent through the VDP. I’ll wait a week or two and see if there’s any update.

Small Winds - No. 02

Fri, 16 Aug 2024 20:53:25 +0000

A personal mini blog about infosec and life

The past week and a half was not very productive since I was unwell most of the time.

It was probably a mistake, but last weekend my partner and I decided to buy an XL pizza from the best pizzeria in town according to us.

We realized that by ordering directly from the pizzeria’s website, we pay the same for an XL pizza as we would for a family-size pizza using Wolt food delivery app.

Anyway, this size was probably too much for me.

Weekly Activities and Notes

I submitted my first CVE request. Let’s wait and see if it is approved.
I sent my first VDP to the Israel National Cyber Directorate. It detailed a local file inclusion vulnerability in a very large Israeli company. By reading the environment variables (/proc/self/environ), it was possible to retrieve sensitive information such as a secret used for authentication for one of their services.
Although I don’t use them much, I was thinking about comparing the results of BuiltWith and Wappalyzer. I added this to my To-Do list.
About two weeks ago, Trail of Bits hosted a webinar with James Kettle (Director of Research at PortSwigger). They discussed several tips regarding Burp Suite, introduced the new Intercept tool, and talked about a few other topics. Some of James’ and Trail of Bits’ suggestions were:
PortSwigger has created a new Discord server. It might be a good place to have discussions with other researchers. Invitation link: https://discord.com/invite/portswigger
James Kettle has published new research about timing attacks and their major impact on web applications. He published an article a year ago, but it was more theoretical. This time, it’s not theoretical anymore. He has found a way to perform this attack on many web applications and shows how to do it. I haven’t finished reading the article yet, but I surely plan to do it. Link: https://portswigger.net/research/listen-to-the-whispers-web-timing-attacks-that-actually-work

CTF

Last weekend I participated in LIT CTF. I did not plan to publish an independent post with writeups because it wasn’t very challenging, so I will write the solutions of two of the challenges here:

web/jwt-2: The Express web application uses JWT for authorization to access the flag. There are 4 conditions:

This means that all we need is for our signature to match the expected signature. What do we need to generate the expected token?

According to section #3 in the image, we need:

To create an HMAC object using the jwtSecret, which we have:

The header and payload JWT sections. So nothing prevents us from generating this signature and using it in our modified JWT where the ‘admin’ property is set to ’true’:

web/kirbytime - In this challenge we should essentially guess the password using a timing attack. For each correct character, the system waits 1 second. This way, we can try all of the characters and determine the correct next character. We can do this using a script or manually.

Small Winds - No. 01

Wed, 07 Aug 2024 16:24:53 +0000

A personal mini blog about infosec and life

Recently, I encountered a blog that inspired me to create a more personal mini blog as part of The Security Wind. I plan to post on a weekly or biweekly basis, and it will probably include more personal stuff and thoughts, combined with other things related to information security - likely interesting things I’ve learned, plans, tips and whatever else comes to my mind :)

I will probably know better later on.

A while ago, I had some kind of emotional buying urge (is there such a thing? Probably). It started with the revelation (🙄) that I am not where I want to be professionally regarding application security. More specifically, I wanted to get better with browser internals, beyond the basics. I wanted to buy a physical book because I often read a lot on my computer and was looking for a different option (as well as the fact that I enjoy reading from physical book and they’re easier for me to read while commuting).

I did some research and found two books that met my needs: The Browser Hacker’s Handbook (2014) and The Tangled Web (2011). They are a bit old but a lot of the content is still relevant.

So it started with the idea of buying one book and I found myself ending up with seven.

My reasoning behind buying each book:

The Browser Hacker’s Handbook (2014), The Tangled Web (2011) - They teach about browser internals. I wasn’t entirely sure if one book offered more information on certain subject so I bought both to have both perspectives.
Attacking and Exploiting Modern Web Applications (2023) - Some modern attacks, technologies and perspectives that I would like to read about.
Web Security for Developers (2020) - To better understand security from the development point of view.
Real-World Bug Hunting (2019) - To learn tricks that I’m not aware of.
**Bug Bounty Bootcamp (2021), **JavaScript for hackers (2022) - Don’t ask. Aside from my buying urge, these books were recommended and they probably offer more tips and tricks.

Weekly Thoughts

A few weeks ago I started reading ‘The Browser Hacker’s Handbook’ but because of an issue, I temporarily stopped and switched to ‘Real-World Bug Hunting’. I began creating some kind of checklist of things I want to test in penetration tests. Some of them are specific (for example methods I use to cause detailed error messages) and others are more general. I use this book to add ideas and attack types to this checklist.
I’ve finished about half of the book so far, and it’s well written. It explains several attack types, provides examples of interesting bug bounty reports that have been disclosed, and a takeaway for each example. Although I’m already familiar with a major part of this book, there are some techniques that are new to me or perspectives that I find beneficial.

One bug bounty report mentioned in the book is this one: https://hackerone.com/reports/127703/ In scenarios where the CSRF token is correctly implemented, we might find the CSRF token in certain JS files. Since loading JavaScript files from another origin does not violate the Same Origin Policy, when the victim enters the attacker’s website, it can load the script which contains the victim’s CSRF token and send a request with the CSRF token included.

For some reason it reminded me of the Same Origin Method Execution (SOME) attack: It probably reminded me of this attack because both methods rely on loading a script to bypass the SOP restrictions and perform an attack. This made me more aware of the possibility of abusing this behavior in loading scripts when needed.

I’ve started creating a tool for bypassing WAFs or CDNs by trying to find the actual server’s IP address hidden behind the CDN IP address, using three different methods. I hope to have updates next week.
I created a new page in my Notion account for new tools or things I want to do before or during future tests. Some of them are:

BSidesTLV 2024 CTF

Thu, 27 Jun 2024 17:00:10 +0000

This year I participated with Flag Fortress 2, and we reached the 2nd place (which is well above my goals I set for myself two years ago).

Here are writeups of two of the challenges:

Web - Call the Manager pliz!
Radio Frequency - Covert Signal

Web - Call the Manager pliz!

After accessing the challenge link, we are redirected to /fetcher. We’ll get back to it later. We can also notice that the source code ZIP is commented in the HTML.

After downloading it we can view the following routes and controllers:

Let’s start with the ‘flag’ route (this is what we eventually want, right?).

According to the code, when accessing /flag, before the execution of ‘FlagController.getFlagFinaleFlag’ method there are two middleware (Middleware are functions that process requests and responses, sitting between the server receiving a request and the controller). One of them is for token authentication and the other is for validating that the user role is ‘admin’.

Inside this controller we can see that the mentioned method probably reads the actual flag. But we can see that there is another method (getFlags) that was not mentioned in the /flags route or anywhere else in the code, and it is vulnerable to SQL Injection.

Although it is not implemented in the code, let’s try accessing it anyway using the /flag route, and the parameter mentioned in the code (id). It seems we need an access token.

Searching the code for this error, brings us to the ‘authenticateToken’ middleware.

So we probably need an account. The ‘users’ route mention a creation process but there is a middleware that checks that the request originates from localhost.

The method requires username and password, and we cannot control the user’s role which is set to ‘user’.

Back to the /fetch path, we can exploit an SSRF vulnerability (can also be identified in the code). Using that, we can set the domain as ’localhost’ and bypass the localhost middleware. We can see that we are able to create a new user, login with its credentials and receive an access token (the login functionality can also be understood from the code).

Using the access token, we can exploit the SQLI I have mentioned earlier. In a normal behavior it should return ‘id’ and ‘flag’ which are integer and string so we should keep this structure so there will be no errors.

I guessed that the first user probably has an ‘admin’ role, so searched for the first user. It makes sense since the challenge author’s name is Liav (it is also possible to replace ‘username’ with ‘role’ in the payload just to make sure).

Same for password:

I logged in with these credentials, retrieved the access token and accessed /flags/flag.

Radio Frequency - Covert Signal

The challenge provided a WAV file that sounded very similar to an SSTV transmission (https://www.youtube.com/watch?v=SffT9U8scBc), so I said to myself, ‘Oh, this should be easy,’ and opened the SSTV software I usually use (RX-SSTV). After trying different modes, I realized there was more to it.

I had a hunch from the start that it would not be straightforward and that the challenge description probably contained hints. Some of the keywords would likely be Olivia, 4:00, and 125.

After searching a bit, I discovered that Olivia is the name of an MFSK mode, which is a method of delivering data (usually text) using radio frequencies, compared to SSTV, which is used to deliver image data.

I downloaded some software and struggled a bit in the beginning.

But then I downloaded one that seemed pretty simple to use.

After choosing the correct mode (Olivia OL 4-125) and loaded the WAV file, the flag was written letter by letter.

Happy Hacking,
Orel 🥥

TBTL CTF Web Writeups

Tue, 14 May 2024 00:13:15 +0000

Challenges:

Rnd For Data Science
1. Butterfly

Rnd For Data Science

Vulnerability: Injection in Pandas library query allows to bypass filtering restriction

This challenge included two files whose general purpose was to retrieve column names and a delimiter from the user and to create a CSV file from them.

The server uses the column names as headers for the table and fills the table with random numbers.

After that, it adds another row (the 11th row) that inserts the flag into the second column place.

 def index():
 delimiter = request.form['delimiter']

 if len(delimiter) > 1:
 return 'ERROR'

 num_columns = int(request.form['numColumns'])
 if num_columns > 10:
 return 'ERROR'

 ** headers = ['id'] + [request.form["columnName" + str(i)] for i in range(num_columns)]**

 forb_list = ['and', 'or', 'not']

 for header in headers:
 if len(header) > 120:
 return 'ERROR'
 for c in '\'\"!@':
 if c in header:
 return 'ERROR'
 for forb_word in forb_list:
 if forb_word in header:
 return 'ERROR'

 csv_file = delimiter.join(headers)

 for i in range(10):
 row = [str(i)] + [str(rnd.randint(0, 100)) for _ in range(num_columns)]
 csv_file += '\n' + delimiter.join(row)

 **row = [str('NaN')] + ['FLAG'] + [flag] + [str(0) for _ in range(num_columns)]**
 csv_file += '\n' + delimiter.join(row[:len(headers)])

 return csv_file

Then it sends this table to the main app to create a CSV file.

@app.route("/generate", methods=['POST'])
def generate():
 data = request.form
 delimiter_const = 'delimiter'
 r = requests.post('http://127.0.0.1:5001', data=data)

 if r.text == 'ERROR':
 return 'ERROR'

 csv = StringIO(r.text)

 df = pd.read_csv(csv)
 
 # Filter out secrets
 **first = list(df.columns.values)[1]**
 **df = df.query(f'{first} != "FLAG"')**
 

 string_df = StringIO(df.to_csv(index=False, sep=data[delimiter_const]))
 bytes_df = BytesIO()
 bytes_df.write(string_df.getvalue().encode())
 bytes_df.seek(0)

We can see that the server takes the second column name: first = list(df.columns.values)[1]

And here it performs a query to retrieve all rows where the value in the second column does not equal ‘FLAG’:

df = df.query(f’{first} != “FLAG”’)

Let’s debug it and run it locally.

After entering two columns named “col1” and “col2”, we receive this table. As we can see, the flag was not included in this table.

By debugging the code, we can see that before the filter, the table includes the flag (SecretFlag), and after the filter it is not included.

So we need to find a way to alter the the table structure or alter the query, using one of our inputs.

Just like SQL Injection, we can inject to the pandas query a comment and it will ignore everything that comes after it.

By entering a number in the query it returns the corresponding row.

So assuming our first column is named “10#”, the query will look like this:

df = df.query(f'10# != “FLAG”’)

and be interpreted as **df.query(‘10’) **which contains the flag.

After filtering the query returned a table that lists the columns and values of row number 10.

And the CSV file will contain the flag:

Butterfly

We have access to a web app:

I did not see any functionalities or interesting requests, so I checked the source code and the browser’s storage.

The LocalStorage and SessionStorage contained a key and this string: {“code”:“CryptoJS.AES.decrypt(CIPHERTEXT, KEY).toString(CryptoJS.enc.Utf8)”}

I assumed that the key should be in the KEY position, but where is the ciphertext?

Looking in the source code I saw a big obfuscated JavaScript code. I used online deobfuscator and beautifier and this was part of the deobfuscated code:

I tried to understand what may be the ciphertext. Maybe part of the ’enc’ array or the full string after joining them together.

However, after checking online what the ciphertext should look like, it was less likely that this was the ciphertext because of its length, structure and different characters.

Knowing that the ciphertext had been altered, I continued to explore other interesting parts in the obfuscated code.

Some of them were “transaction” “readwrite” “target.result”. I googled them together to understand what are they related to and understood they are related to IndexedDB.

IndexedDB is a NoSQL database provided by modern browsers. It saved the data on the client-side, in the user’s local system. In order to retrieve the data from it, the user need to use JavaScript.

I asked one of the LLMs how to retrieve data from IndexedDB, it gave me a script that needed a small modification and updating the database name and the store object that were “strangeStorage” and “FLAG”.

I retrieved the ciphertext from the DB, and decrypted it.

Thanks for reading,
Orel 🌑

Large Language Models for CTFs

Wed, 01 May 2024 14:54:44 +0000

I really like using Large Language Models (LLMs). One of my uses for them is solving CTFs.

Recently I started comparing a couple of them, especially since there have been some major updates lately.

I was curious and wanted to create a table that would compare their capabilities in solving CTFs. My significant other then asked me why not write an article about it, so here we are😉.

I read some opposing views towards using LLMs for CTFs. However, for me, using them is the same as googling and searching the web for learning, and trying to find answers to challenges or tasks we have. If we had the option to use google much more efficiently and find the results we want right away, I believe most of us would do that.

Some people may say that LLMs solve the challenges for us, unlike searching the web, and some of that is true, but not always.

I would divide it into two situations:

When we are focusing on getting points or solving tasks: In this case, I see no problem with using all the tools we have in order to be the most efficient and do what we want in the fastest way possible.
When we want to learn and understand how to do things: From my experience, often (or even the vast majority of times), the answer is not presented right away and I think that:

By getting the LLM output and the results, we also learn by reading the solution.
We still think and learn because a lot of times the LLM gives us only leads and we have to test them and continue using the hints and leads we have received. So we will still try to solve the challenges on our own.
Sometimes we simply request the model to explain a code snippet, a certain technology, etc., and not really ask it to solve the challenge.

The Models I Used

Some of the top and most interesting LLMs that I was familiar with include:

OpenAI GPT 4.0
Claude 3 Opus
Google Gemini Pro 1.5
Pi - Inflection-2.5

There are some additional LLMs that I did not test or partially tested. For example:

Microsoft Copilot, since it uses GPT 4.0 and this model is already part of the comparison, so I assumed there should be no major differences.
Some LLMs that were just not good enough.
Google Gemini Ultra 1.0 which should be Google’s best model and requires a monthly payment. It is impossible to work with because the security mechanism stops conversations or deletes links many times. It is a bummer since I believe Gemini could help a lot. Here are some of its behaviors:

The Comparison

The following table shows which LLMs succeeded in solving the different challenges.

A couple of notes:

The results combine which LLMs succeeded in solving the challenges and how many prompts (hits) it took. The main goal was to understand which model is the best for CTF competitions.
I usually sent the same prompt to all the LLMs, including the CTF description, any provided files or code, and my request. Also, I gave each of them a similar number of attempts before considering the result as failed.
The challenges I used for comparison came from different CTFs, which I had already solved or had solutions for. They were mainly Web and Forensics challenges, because these are the categories I usually focus on, but I know it is possible to solve or get help for other categories as well.
I will provide a general description and notes for each challenge in the section following the table.

	GPT 4.0	Claude Opus	Gemini Pro 1.5	Pi 2.5
.git Challenge	1 hit (.git and Directory Brute Forcing)	Directory Brute Forcing	Directory Brute Forcing	Directory Brute Forcing
Secret PNG in PDF	3 hits	3 hits		3 hits -instructed to extract only JPEG
Zip Slip Symlink	1 hit	1 hit		1 hit
JS/LocalStorage Manipulation	1 hit	1 hit	1 hit	1 hit
Prototype Pollution	Only identified	5 hits - almost exploited	Only identified	Only identified
Parameter Pollution	2 hits	1 hit
Message in RGB Values	3 hits
LLM Token IDs	Suggested other models
Hidden Data in ShellBags			1 hit
Prompt Injection #1	5 hits		2 hits	5 hits
Prompt Injection #2	7 hits			5 hits

.git challenge - There is only access to a simple website. The solution is downloading the .git folder and searching for the flag in previous commits.
Secret PNG in PDF - A PDF file contains a secret PNG with the flag but does not display it.
Zip Slip Symlink - A website with the functionality of uploading a ZIP file, extracting it and reading the extracted files. The solution is to upload a ZIP file of a Symbolic link, pointing to the flag’s location.
Simple JS/LocalStorage Manipulation - A button that needs to be pressed a many times to reveal the flag and the clicks are stored in the LocalStorage. Everything is on the client side.
Prototype Pollution - A website containing two main functionalities. Claude Solution (the correct solution is without “secret”):

Parameter Pollution - A website that allows registering, login, and donating money. As a user, you start with $1000, and can only donate to Jeff Bezos, not other users. The goal is to gain more than a certain amount of money to obtain the flag.

The solution was to create a couple of users and send money to one of them using:

to=lisanalgaib&to=orel&currency=1000

Message in RGB Values - The challenge provided a small square image with random colors in each pixel:

The solution is to take each pixel’s RGB values, combine them and convert to ascii which will result in a message containing the flag.

Note: all the tested LLMs mentioned solutions related to RGB values but only ChatGPT suggested to sum them.

LLM Token IDs - For this challenge we were provided with LLM tokens: [2864, 35, 1182, 37, 90, 28936, 8401, 821, 2957, 5677, 265, 7037, 40933, 29415, 92].

The solution was to find the correct model that translates these tokens to the flag.

While ChatGPT didn’t solve it, it suggested trying different models and understood it needs to be translated to words/the flag.
For some reason Claude acted like GPT 3.5 and was sure that the flag is UMDCTF{hackerman}
Gemini 1.5 went too far and suggested unrelated solutions.
And Pi was sure the flag is UMDCTF{DontUnderestimateVladimirHarkonnen} 🤦🏻‍♀️

Hidden Data In ShellBags - The challenge provided a VDI file and we had to find some deleted information that still exists in ShellBags (https://www.hackingarticles.in/forensic-investigation-shellbags/).

Gemini was the only one that suggested a correct and a quick solution.
Claude was pretty close but its solution did not work for me.

Prompt Injection - The LLM should not generate any code.

Claude Opus did not want to help because of unethical hacking reasons.

Prompt Injection - The LLM should not display the password.

Claude Opus did not want to help because of unethical hacking reasons.

Conclusions and Final Thoughts

In conclusion, here are the results (excluding the partial solutions):

Model	Number of Successes	Web Challenges	Forensics Challenges	Misc Challenges
GPT 4.0	7	3/4	3/4	1/3
Claude Opus	5	4/4	1/4	0/3
Gemini Pro 1.5	4	1/4	1/4	2/3
Pi 2.5	4	2/4	0/4	2/3

General Impression

The top models I have found to be the most intelligent were GPT 4.0 and Claude Opus.

There are two main disadvantages of Claude compared to ChatGPT:

The fact that sometimes it will not help with prompts it perceives as malicious.
Its inability to run code, which limits its capabilities and sometimes leads to nonsense outputs (similar to GPT 3.5).

Moreover, it seems to me that GPT 4.0 is slightly better. There are times when it understands the context better and mentions one small additional piece of information that makes a huge difference.

There are some tasks that Gemini was really good with (it is also very good with summarizing the results, the leads and next steps), but in general it is not good enough, especially when comparing to GPT and Claude.

I really wish I could use Gemini Ultra for this for this, but its limitation makes it irrelevant.

Although Pi 2.5 is perceived as less intelligent than the others (by intelligence, I mainly mean understanding and staying in context, having sufficient data, and solving the task), there were times it provided surprisingly helpful outputs, sometimes even more than other models.

Performance By Category

ChatGPT’s results with web and forensics challenges are very good. I believe its poor score in the misc category was due to not trying enough challenges in this category, and because two of the three misc challenges were related to prompt injection, which it seems it is really bad with.

I actually believe ChatGPT should be good with misc challenges since it has an advantage as it can run and generate pretty good code as I saw in other challenges not mentioned in this article.

Claude performed VERY well with the web challenges but quite poor with the forensics challenges. One reason for its poor score in the misc category is its refusal to help with prompts considered malicious (the prompt injection challenges).

Gemini and Pi had about the same results across all of categories, so no special comments for them.

I hope you enjoyed reading.

Feel free to contact me if you have further insights, different opinions, or anything else.
Orel 🕵🏻‍♀️

UofTCTF 2024 Writeups

Wed, 24 Jan 2024 15:53:03 +0000

This time we reached the 83rd place out of 1225 teams, which is a really nice score.

Although it wasn’t a very hard CTF, I found it fun and some of the challenges were challenging.

Voice Changer - Web

The Varsity - Web

No Code - Web

Guestbook - Web

Hourglass - Forensics

Flying High - Osint

Voice Changer - Web

This challenge provided a link to a voice changer web application.

The request contained parameters that were related to the pitch and the uploaded recording.

In the server’s response we can see that the web application used ffmpeg command which is a video/audio handling software, in the operating system shell.

After I analyzed the web app behavior, I noticed it used the ‘pitch’ parameter as ffmpeg command argument, I tried breaking out of the command execution context and running an additional command.

uoftctf{Y0UR Pitch IS 70O H!9H}

The Varsity - Web

In this challenge, we got a website that allows the reading of newspapers, but some of the newspapers are for subscribers.

We also got the source code.

We can see that article 10 is only for subscribers.

I could not find a way to be a subscriber (bypassing the voucher option in the registration form) so I checked for business logic related bugs.

If we enter ‘9’ (which is actually the 10th issue) as the issue number, the code will enter the second ‘if’ statement and will return an error.

However, if we enter ‘9;’ as the issue number, it will not enter the second ‘if’ statement because

issue >= 9

returns ‘false’ as ‘9;’ cannot be parsed as a number.

After that, the string ‘9;’ enters:

issue = parseInt(issue);

The ‘issue’ variable value will be 9 because parseInt() function parses all the input until the first non-numerical character.

Now, since the ‘issue’ variable is integer and is in the articles range, it will not enter the next if statement:

if (Number.isNaN(issue) || issue > articles.length - 1) {

And then it retrieves issue number 9 that contains the flag:

return res.json(articles[issue]);

uoftctf{w31rd_b3h4v10r_0f_parseInt()!}

No Code - Web

We received a link and a source code of a web application.

It contains the POST /execution route.

Using regex, the code checks if the value at the beginning of our string is in the range of the ASCII characters. If the value is within the ASCII range, the program returns an error; otherwise, it executes the code.

We can see that by forming a POST request and send our code, it returns an error because the characters are within the ASCII range.

However, by adding a newline (using its URL encoded value) at the beginning of our code, it passes the regex check and runs the code.

uoftctf{r3g3x_3p1c_f41L_XDDD}

Guestbook - Web

In this challenge we got an HTML File. I opened it in the browser and in VS code. Note that the sheetID is exposed and we can view only the last entries.

By Googling/using ChatGPT, I understood that I could try accessing a certain sheet using its sheet ID with the following URL: [https://docs.google.com/spreadsheets/d/sheetID}/edit

I entered this link using the sheet ID in the code and I retrieved the flag.

uoftctf{@PP_5cRIP7_!5_s0_coOL}

Hourglass - Forensics

This challenge provided an OVA file of Windows 10. According to the description we need to find something suspicious in the system.

I searched in different areas that might contain interesting or suspicious data.

I did not find anything until I entered the Task Scheduler and noticed a suspicious task that mention some path (C:\Windows\DiagTrack\Settings\settings.txt)

Here we can see the ’txt’ file mentioned in the suspicious task, which looks like a Base64 encoded string.

This is the decoded string, which is the flag:

uoftctf{T4sK_Sch3Dul3r_FUN}

Flying High - Osint

So, according to the description, we had to find the airport, airline of the rightmost airplane, and airplane model.

This is the image we got:

By zooming in we can see that there is some kind of hangar with ‘NOVESPACE’ written on it.

Googling ’novespace airports’ result in this web page. It says that this company operates mainly for scientific and technical research programs and it’s based in Bordeaux-Merignac Airport.

After searching this airport in Google Maps, we can notice that there is a place called Novespace. By clicking on it, we arrive the the same place as in the image.

We can notice that this image if from July 2012.

Regarding the airline company, it was pretty easy to find it by google searching its logo description.

For the aircraft model, I tried all of the current aircrafts they use unsuccessfully, but then I remembered that the photo was taken in 2012 so I searched in the former fleet section. I tried a couple of models that were used in 2012 until I got the correct one.

Thank you for reading. I hope you learned something new.
Orel 🪷

MetaRed CTF Argentina

Sat, 28 Oct 2023 01:32:55 +0000

In this CTF we finished in 26th place.

Here are two writeups of challenges I have solved.

I didn’t put many screenshots since the CTF was down not long after it was ended.

Shuffle - Forensics
Extracttheflag! - Web

Shuffle - Forensics

I was provided with a binary file.

I tried to identify what this file is using the ‘file’ command but it could not identify it.

‘File’ command usually checks Magic Numbers and the Magic File to determine the file type.

“Magic bytes” are a sequence of bytes that appear at the beginning of a file and are used to identify the type of the file. This sequence of bytes is sometimes called a “magic number” or “file signature”.

For example, these are the magic bytes of a PNG file (left: Hex, right: ASCII)

(Here’s a large list of different magic bytes: https://www.garykessler.net/library/file_sigs.html))

I opened it in Notepad++:

It looks like a PNG file. We can understand it from the beginning of the file, which looks like the Magic Bytes of a PNG file type (as shown before), but something is broken. From my experience, I know that the “PNG” ASCII characters should be on the same line.

After trying to change it manually without success I opened the file in ‘010 Editor’ (a great hex editor):

Let’s examine the hexadecimal sequence for the beginning of a PNG file and identify any discrepancies.

The sequence of a PNG file type should always start with the following hexadecimal sequence:

89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52.

This sequence is the magic bytes and the beginning of the IHDR chunk.

Wait, what is IHDR chunk? What are chunks?

“Chunks” are the building blocks of the file format. A PNG file is made up of multiple chunks, each of which conveys certain information about the image or the data it contains.

For example, some of the chunks for PNG file are IHDR, PLTE, IDAT, sRGB and many more.

This is the chunks structure for PNG file:

Length: A 4-byte integer that specifies the length of the **data field **of the chunk (number of bytes dedicated to it.
Type: A 4-byte chunk type code. For example, “IHDR”.
Data: The actual data bytes of the chunk.
CRC: A 4-byte code to check if chunk data has changed.

For example, these are the length and type section of the IHDR chunk which always stay the same (0x08-0x0B, 0x0C-0x0F respectively):

So… back to the challenge, the initial sequence (first 16 bytes - file type signature and some sections of the IHDR chunk) always remains the same.

However, in this case, it appears to be shuffled:

Initially, I attempted to manually correct the sequence, but the image remained corrupted.

I realized I might have to correct the entire hexadecimal sequence. But I can’t determine the original sequence unless there’s a pattern. Maybe some of the hexadecimal values were swapped with each other. Let’s manually fix the sequences that I already know (those that are always the same), and see if there’s a clear pattern in the shuffling:

The orange text marks the hex that I manually fixed.

It seems that the shuffle goes in this pattern:

Keep the first 2 bytes as they are.
Replace the 3rd byte with the 5th.
Replace the 4th byte with the 6th.
Continue this pattern for the entire file.

I asked ChatGPT to create a script for me to reshuffle the bytes using the pattern I provided:

I opened the new file, and I got the original file:

Extracttheflag! - Web

I’ve got the source code of a PHP page. Here are the interesting parts:

A session is started, and the admin session variable is set to false.

I checked what the extract() function is.

Note that it’s insecure to use untrusted data for this function from user input.

In PHP, the extract($_POST) function is used to convert POST request data into corresponding internal variables.

When PHP runs the extract() function on the $_POST array, it creates variables that mirror the array’s contents. This can pose a security risk if extract() ends up overwriting pre-existing variables, which, in our scenario, is exactly what happens.

According to this code part, my session’s admin variable should be true in order to see the flag.

Sending a POST request with _SESSION[‘admin’] set as ’true’, would cause the session admin variable to be rewritten and the flag would be exposed:

curl 'https://extracttheflag.ctf.cert.unlp.edu.ar' -X POST -d _SESSION['admin']=true

Happy Hacking,
Orel 🧩

DEADFACE CTF 2023

Tue, 24 Oct 2023 00:09:15 +0000

The theme of this CTF was an evil hacker group called “DEADFACE”.

Additionally, there were some other groups and companies that were part of the storyline.

The CTF contained many challenges, many of which I would define as beginner-intermediate level.

We reached 70th place out of 1100 teams.

shout out to the admins on being very friendly

This blog post will contain 3 forensics/steganography challenges that I solved:

Syncopated Beat - Steganography

Tin Balloon - Forensics

Electric Steel - Steganography

Syncopated Beat - Steganography

I downloaded a zip that contained two audio files:

I played the first audio file and in the middle of it, there was a part that was sound like a reversed audio,

I opened Audacity, reversed that part and it said that I have to use the steganography software from Mr. Robot and the password for the file is the new CEO of Evil Corp, I googled both things, and found that there’s a software called DeepSound.

I opened the second audio using this software.

I used the password and extracted the hidden file.

Tin Balloon - Forensics

After downloading the zip file, there are two files - an audio and a doc file.

The doc file was encrypted with a password and once again, part of the audio sounded strange.

I opened the audio with Audacity, trimmed the part I wanted, used the spectrogram option, and found the doc’s password which contained the flag.

Electric Steel - Steganography

I downloaded the image:

I used binwalk tool to search for hidden files:

One of the hidden files was tar file:

Happy Hacking,
Orel 🍵

UMDCTF 2023

Tue, 02 May 2023 15:25:44 +0000

Together with members of the Hallios community and CyberSecMaverick, I participated in UMDCTF 2023.

The CTF theme was Pokémon and I really liked its design and style of the website and challenges themselves.

We reached 86th place which is a respectable position for this CTF.

I’ll mainly share writeups of challenges I solved that I found interesting.

Web - pop calc
Web - notsogeo
Misc - ChungusBot v3

WEB - pop calc

The challenge provided a link to a web application:

Trying to make valid operations resulted in this HTTP request/response (I deleted some of the request headers only for the writeup):

Performing invalid calculation resulted in an error and reflects the input:

I tried to understand the system behavior, tried various injections (sqli, ssti, etc.), sent fuzzed inputs and tried many different kinds of attacks unsuccessfully.

Trying SSTI:

An SSTI (Server-Side Template Injection) vulnerability is a type of security weakness found in web applications. When a web application uses templates to generate dynamic content, it may allow user input to be included in the template without proper validation or sanitization. This could potentially allow an attacker to inject malicious code into the template, which is then executed on the server-side when the page is rendered.

I didn’t find anything interesting (except the internal server error.

I had fallen asleep and I dreamt about sending some input which caused the server returning information about a service called ‘pop’ 🤷🏻‍♀️.

I woke up and thought a little bit. I looked at my SSTI payload and noticed that my payload’s syntax might be incorrect.

I sent a different payload:

Now I am 100% sure it’s an SSTI issue.

I checked Hacktricks for payloads and tips and used an RCE payload to read the flag.

WEB - notsogeo

This challenge generally asks us to cheat on GeoGuessr games.

GeoGuessr is an online geography game that uses Google Street View to place players in random locations worldwide. Players must guess their location by examining the environment for clues and then placing a pin on a world map.

The challenge provides a source code of a version of this game.

Using the source code, we can try to identify a way to guess our coordinates and guess our correct location on the world map.

I entered into the game.

The game source code:

From the challs.json file and other files, it can be understood that those are the locations that will be part of the game.

We have to guess the correct coordinates to get the flag.

The locations consist of ‘pano’ (id of the location) and coordinates. However, we don’t have access to the files.

Going through the HTTP requests, I could not find the coordinates. However, I kept seeing something called “panoid” which sounded like the location ID.

Searching Google “Find coordinates by panoid” results in this Google Street View documentation:

So we got the ‘panoid’ and have to find the Google Maps key. Searching for the term “key=” results in this:

Constructing the URL we found in the Google Street View documentation by adding the ‘panoid’ and ‘key’ values, gives us the coordinates.

Using the coordinates, we select to correct location on the map and get the key :)

MISC - ChungusBot v3

We can find the Discord bot source code in Github.

Reading the source code we can understand that the flag is divided to four parts.

The first part asks to send the URL in the code (which translates to a gif).

The second part of the flag will be revealed after we guess the correct coin random flips.

Third part will be revealed after we send four numbers that will answer the following sentence.

The fourth part will be revealed after sending a file that will contain the text “You like jazz?” and will be 100 or more characters long.

Now we have obtained all the flag parts :)

Happy Hacking,
Orel 👒

Space Heroes CTF

Mon, 24 Apr 2023 15:24:55 +0000

Playing with Cyber R0nin team,

Here are several writeups of some of the challenges:

attack-strategies - WEB
Bank-of-Knowhere - WEB
Bynary Encoding - Crypto
Time Leap - Forensics

attack-strategies - WEB

Entering the link, we can see that we can choose a folder and a file. Also, we see that there is a ‘show_hidden’ cookie set to ‘false’.

After changing the cookie’s value to ’true’ we can see the updated ‘folder’ list, and that flag.txt exists there.

Choosing flag.txt returns an internal server error

Pressing ‘View’ returns a general error that indicates that the file/folder does not exist.

I assume it’s because of the fact that flag.txt is not a folder but a file.

So I’ll try to use LFI to retrieve this file.

LFI (Local File Inclusion) is a security issue where attackers include local server files in a web application’s output, exposing sensitive info. “../” is used to move up one level in the directories structure, helping them access unintended files.

Bank-of-Knowhere - WEB

As the challenge description says, only those with at least $2000 are in the inner circle and can get the secret information.

We can see that we have $850.

I had two ideas - trying to gain more money or trying to retrieve other users’ information.

This is the money transfer request. I tried to send myself money from other usernames, tried to play with the amount, SQL injection, and various attacks but they didn’t work.

Trying to send money to myself (Groot) from another username (Rocket) caused an error.

The solution to this challenge is Parameter Pollution.

Parameter Pollution is a security flaw where attackers manipulate web app inputs by injecting extra parameters, causing unexpected behavior and potentially gaining unauthorized access.

In the context of this challenge, sending two of the same ‘receiver’ parameter bypasses the server’s restriction. Probably because the check is for the first ‘receiver’ parameter and it sends money to the last ‘receiver’ parameter.

Now we have more than $2000.

I still didn’t see the flag, and I tried to enter different directories like ‘/flag’, ‘circle’, etc. but didn’t find anything. After brute-forcing different directories, I saw that the robots.txt file exists and contains the directory /admin.php

Bynary Encoding - Crypto

After downloading the file, it looks empty with a lot of spaces, but trying to delve a little deeper we can notice that the text is tabs and spaces. Combining it with the challenge name and description, we can assume that it’s related to binary (base 2).

Replacing spaces with 0 and tabs with 1 results in this:

Converting it to text:

Time Leap - Forensics

After downloading the file and decompressing it, we got an .img file which we can’t load normally (at least I couldn’t when I tried). I opened it with Autopsy and saw the flag as a deleted gif file:

I hope you enjoyed,
Orel 🎍

BDSEC 2022 CTF Writeups

Thu, 21 Jul 2022 18:34:48 +0000

I will share my way of thinking and how I solved two challenges.

Dominoes (Cryptography - 50)

Knight Squad Shop (web - 100 points)

Dominoes (Cryptography - 50 points)

We got the encrypted flag:

And we got the python code which encrypted the flag.

Red mark: reads the flag and then sends it to the encryption function (y).

Green mark: (I replaced an obfuscated character with “clearText” for readability). For each character in the flag, it makes an XOR operation (^ - I will use it interchangeably) with the XORed value of it (more precisely, with the integer representation of it - A=65).

For example, if the flag is “BDSEC”, the integer representation of “B” (66) will be XORed with “9” (57) which is “{”. Then “9” XORed with “D” is “{” as so on, as can be seen in the encrypted flag.

It’s possible to make a reverse operation for XOR:

The encrypted flag is: 9{?l)jO;dQa>[oZ#|A)I}N}

9 ^ original_character = {

{ ^ original_character = ?

So I wrote a python code that checks if 9 ^ original_character = {* *and so on.

Each character of the encrypted message was tested with different characters in order to guess the correct one.

Knight Squad Shop (web - 100 points)

The source code of the web application was provided:

https://drive.google.com/file/d/1cHCasWHdfl21q2XrATET_jy0fDQ2gfMK/view

Also access to the web application:

It seemed that there is a ‘products’ object and one of its instances is ‘flags’ which contains the flag.

This is what I wanted.

How do I get it? Let’s look further into the code.

There are two endpoints: /sell and /buy that are responsible for the buying and selling operations.

Since there was a bug or misconfiguration, I could only try to buy ‘digispark’. However, I did not have enough money for it.

I tried to sell products by manually crafting a request to the* /sell* endpoint and tested some things but I did not see any changes.

How can I get more money?

Looking further into the code, I saw there is another endpoint (/money), that checks if I have an admin session, and if so, it adds the money amount I request in the ‘money’ parameter.

As I thought and as the code says, I’m not an admin.

How do I get an admin session?

Looking at the code again seems like the request IP should be originated from ‘127.0.0.1’ in order to get an admin session.

Before continuing a bit of information about ‘X-Forwarded-For’ header:

Basically, front-end servers such as proxies and load balancers use that in order to tell the back-end (web application) server from which IP the request originated.

Let’s try it :)

It did not work and I have to find another way.

Maybe if I will cause an error, it will expose interesting information.

I do not know if it is correct but knowing that asynchronous functions are sometimes vulnerable to race condition + I read that ‘req.ip’ could be affected by ‘X-Forwarded-For:’ header, I tried to cause some kind of race condition by adding ‘X-Forwarded-For: 127.0.0.1’ to the request, and changing the ‘Origin’ and ‘Referrer’ headers to this IP address, just in case.

And it worked.

“Money added”.

Using the same session I added **a lot **of money.

But still, I do not have enough money. How is it that my session does not have enough money?

Is there a chance that the money is added to the session in the ‘Set-Cookie’ response header?

I tried to buy the flag by replacing my session with the session in the ‘Set-Cookie’ header and it worked.

I tried it again and only sometimes it works for me so I am not sure exactly if all of these steps were necessary.

Also, before trying that, I uploaded the source code to Snyk for vulnerability scanning and it found a Prototype Pollution vulnerability, and as far as I understood, it may be another solution for this challenge.

Please let me know if there were inaccuracies or any other insights about this solution.
Orel 🍉

BSidesTLV 2022 CTF - "Medium Expectations"

Fri, 01 Jul 2022 14:47:39 +0000

I tried a pretty easy Crypto challenge.

After using Netcat, the server asks us to guess the correct numbers repeatedly.

After looking at the source code (“challenge.py”), it seemed that the server generates a random number in the appropriate range each time.

However, there is an interesting function - random.seed().

After reading about this function, I understood that it takes a number (the result of the operation inside it) and this will be the seed for the random functions (rand_range).

Okay, so it is not actually random. The random seed has a fixed value.

I checked the result of this operation and got a reasonable value, but it did not work after I tried it.

I thought it might be quicker if I just ran this program in PyCharm after modifying and printing the results for each iteration, and it worked. After connecting to the server, I just used the numbers and got the flag.

Happy Hacking,
Orel 🐇

PortSwigger Labs - Cross-Site Scripting Answers

Sat, 18 Jun 2022 19:37:04 +0000

Hi, in this updating blog post, I will post answers and explanations of how I solved them.

The difficulty levels are Apprentice, Practitioner, and Expert.

What is Cross-Site Scripting?

Cross-Site Scripting (XSS) is an injection attack that allows an attacker to inject scripts into websites that will affect other user/s.

The problem arises because lack of input validation and lack of character encoding.

The main XSS types are:

Reflected XSS - User input is returned by the web application in the server’s response without encoding it to make it safe to be rendered in the user’s browser.
Stored XSS - The user’s input is stored in the database of the target server (for example, after post creation in forums, private messages, etc.), then the victim is able to retrieve the stored data without encoding, which makes it unsafe to be rendered on the victim’s browser.
DOM-based XSS - This type of XSS is when all the attack flow stays in the DOM of the browser. The payload will not be sent to the server.

1. Reflected XSS into attribute with angle brackets HTML-encoded

Difficulty: Apprentice

First, I checked which characters were encoded.

In the first reflection, all of them are encoded. In the second reflection ’ and " are not encoded.

I could not escape the element because <> characters are encoded, but I knew I could add an attribute since all I need is the " character.

I added the ‘onmouseover’ attribute, which tells the browser to run a script when the mouse cursor is above this element.

2. Stored XSS into anchor href attribute with double quotes HTML-encoded

Difficulty: Apprentice

The description says there is a stored XSS in the comment section so let’s send a comment and check **all parameters **(sometimes only one parameter is vulnerable).

After entering the comment page, we see that all parameters are HTML-encoded except for some characters of the ‘website’ parameter from the last request.

I sent a similar payload as in the previous lab. After initiating the script by moving the mouse cursor above the element, the lab was considered solved.

3. Reflected XSS into a JavaScript string with angle brackets HTML encoded

Difficulty: Apprentice

In short, XSS inside a script.

As in the previous labs, I tested which characters are not encoded. I only used these special characters: ; and /.

I used // in order to comment out all the remaining characters.

A Race Against Time

Thu, 02 Jun 2022 17:04:46 +0000

There was a delivery service that was introduced to the company I work for. They allowed employees to order groceries without a shipping fee, and get them on the same day.

I was curious and checked a couple of things on the website (security-wise). There were many requests, and I tested some things. After not finding anything interesting, I stopped.

I got back to it a few weeks or probably months later. I really wanted to find something in there, especially since I did not find anything the last time.

Now, this platform usually targets companies and after an onboarding session with a representative, they give you some credits. I will get back to it later.

I registered an account. I wanted to see if there was something interesting on the account’s profile page, so I went there.

Let’s see what happens when I press “Save” for the account’s details.

Hmm, the server’s response contained parameters that caught my eye (’store_credits’, ‘onboarded’ and ‘verified’).

‘store_credits’ probably refers to money and the ‘onboarded’ parameter refers to the onboarding process I mentioned earlier.

I added the ‘store_credits’ parameter to the request in order to change my credits. Sending normal values or unexpected values did not change the number of credits.

Let’s try to change the ‘onboarded’ and ‘verified’ values to ’true’.

Okay, it worked and now I am onboarded and verified. Wait for a second, I also gained credits (3000 credits which are equivalent to 30 New Israeli Shekels)!

Let’s try to send it again, maybe I will get even more credits!

Unfortunately, it did not work.

So we have an authorization bypass here. We can onboard and verify our account and get credits for that.

Then a thought came to my mind and I asked myself - is there a chance there is a race condition here?

As per the OWASP testing guide: *“A race condition is a flaw that produces an unexpected result when the timing of actions impact other actions”. *

For example, in this web application, if there is a race condition, the system will process these requests simultaneously while increasing my credits over and over before noticing that my account is already onboarded.

I created a new account (with 0 credits), prepared the same request, sent it to Burp Suite Intruder (a tool that automates attacks) and sent it many times using a large number of concurrent requests.

This is what I got from the server’s response. It looks like it did not affect the credits and I only got 20 NIS. **😭 **

Also, on the catalog page, it seemed that I only got the 20 NIS discount.

I probably wanted to test further issues when I entered the cart and was surprised to discover that it worked and I have a discount of much more credits than I should have (I should have 20 NIS discount and got 60 NIS).

Here I could get only 60 NIS, but I also succeeded to do that with 120 NIS.

Race condition is fun!

Happy Hacking,
Orel

Forgot Password Vulnerabilities

Fri, 20 May 2022 22:46:33 +0000

I will probably update this post with new examples and screenshots.

One of the features I like to test the most is the ‘forgot password’ process. Since it may lead to account takeover, or sometimes it is like a riddle that you have to solve by understanding its logic.

In my opinion, the probability of ‘forgot password’ issues in a web application is 6-7/10. So it is not very common, but not that rare.

Some web applications require entering the target email address or username. Then they send an email with the ‘forgot password’ link. Usually, there is a form there that asks for a new password. While intercepting the request, sometimes the username is sent next to the ‘forgot password’ token and the new password. The ‘username’ parameter tells the server to change the password to this account. Note that this process could be combined from several requests, so the whole process should be understood.

Another example is a guessable token. Some tokens or ‘forgot password’ links are combined from guessable data, such as company IDs, timestamps, iterators, etc. An example of such a link is:

Let’s say that the ‘c’ parameter is company ID, ‘i’ is an iterator, and ’t’ is some kind of another iterator, maybe an encrypted timestamp.

If we send another reset password request to the same user, we will probably get this link:

As we can see, the ‘i’ parameter’s value has been increased by one, and the ’t’ parameter’s value (in Hexadecimal) also increased. The company ID could also be guessed easily if it is a sequential number or by using other ways.

Now we can send ourselves a reset password request and very fast after that, send a reset password request to our victim. We use the values in the link that was sent to us in order to guess the parameters’ values of our victim.

We know that the ‘i’ value was increased by 1, and we probably know or can guess the victim’s company ID. An automated tool can be used for this attack (such as Burp Suite’s Intruder) and only a few characters should be guessed. It should take a short moment before guessing the correct link.

One of the requests in the ‘forgot password’ process may send the user’s credentials in the URL.

These credentials may be saved in proxy history, browser history, etc. Malicious users who have access to these areas may try to log in or steal the account.

Tokens that can be brute-forced and are guessable (such as ‘9389913’), even if they are random, may lead to account takeovers.
Tokens that are not expired after a limited and short amount of time increase the chances of being discovered. Also, allowing several valid tokens at the same time.
A very common issue (with a very low impact probability) is ‘forgot password’ tokens sent to 3rd parties. Usually, after entering the ‘forgot password’ link sent to our email address, there an analytics and logs requests sent to 3rd parties. These requests usually contain the reset password token in the ‘referer’ header or one of the GET or POST parameters. Data leakage from this 3rd parties website, or a malicious user who has access to this data, may compromise users using these tokens. The probability of this attack is increased as the token expiration is higher.

Reset password poisoning - sometimes, we can try and send a reset password request with the ‘Host’ or ‘X-Forwarded-Host’ headers containing the attacker’s server URL. There are cases where an email message will be sent to the victim and contain a link with the attacker server’s URL, and the ‘reset password’ token attached. After the victim enters the link, a request with the ‘reset password’ token will be sent to the attacker’s server.

Sending two email addresses - some web applications will also send the victim’s token to the attacker in case a similar payload is sent:

email=victim@gmail.com&email=attacker@gmail.com

In other cases, instead of using ‘&’ we can try other characters or URL encoding of them.

Email flooding - some systems allow sending many ‘forgot password’ requests without any anti-automation mechanism or other limitations. By sending many requests, we can flood our victim’s mailbox.

Thank you,
Orel 🌷

Duolingo - Unlimited XP Points

Sat, 14 May 2022 21:20:43 +0000

This is a story about the importance of testing the less popular areas in web applications.

Duolingo gives experience points for different actions on the website. For example, doing challenges.

By increasing the XP points, you go up on the league board.

So I joined a league and unfortunately I only have 8 XP.

It is essential to understand the flow of the web application’s processes and not miss requests and features that seem like edge cases or are not widely used. Because in a lot of cases, they have issues.

So back to our example - Duolingo lessons have a different levels (1-5 and “Legendary”). The “Legendary” level contains a lot of questions and for that, they “promise” 20 XP for those who finish just half of the questions.

So let’s intercept the traffic just before we arrive the middle of the lesson.

I answered the question (the answer was “The bear is beautiful”) and quitted the lesson.

They asked me if I am sure and I said “Yes!”. Nothing happened so I clicked “Yes”.

There were many requests and after finding the request I searched for, I went through all of the parameters (and there were many of them).

There were some interesting ones, and one of them was “xpPromised”.

XP promised?? Only 20? Can you please promise me more?

I changed it to 1329 and it looks good for now.

Lets check the league chart.

Yay, I have 1337 points! Sorry Dena.

Happy Hacking,
Orel

Simple IDOR With Critical Impact

Sat, 14 May 2022 19:10:28 +0000

I have a friend who studied in a popular academic institution. I happened to be in his house and I said why not “look” at their website real quick? They had this new area on the website where all the personal information exists.

It really took only a couple of minutes to find a very critical IDOR (authorization bypass) issue. The issue was that it was possible to (probably) retrieve all the grade chart which contains all of the grades and other personal information of all the students.

For those unfamiliar with the term IDOR (Insecure Direct Object Reference), it is a vulnerability that allows to refer and access an object that should not be authorized to the user.

Sorry in advance for the massive redaction and lack of evidence, I do not want to cause any problems for my friend.

After asking for the grade chart, a POST request was sent and in its body, there was this suspicious parameter (which I am not sure if it is the grade chart ID, the student ID or something else. I did not delve into this).

I edited the “ptMsl” parameter’s value, which of course was a sequential value (which is a problem by itself) and sent the request.

After that, there was a request or more that contained some unique identifiers (that originated from the malformed request) and then I saw a grade chart of another person.

An attacker could automate it to probably retrieve all of the students’ grade charts, which is very bad for the institution’s reputation (in addition to the fact that students’ data were exposed).

I am publishing it after I verified it was fixed, but the fact this absurd issue exited (and for a long time), it is not hard for me to believe there are more issues like this on the website.

Secure development training is very important for websites that contain sensitive data.

Happy Hacking,
Orel

The Security Wind

1753CTF 2025

Challenges

Escatlate (flag #1) - Web

Escatlate (flag #2) - Web

Entropyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy - Web/Crypto

Small Winds - No. 07

Thoughts and Experiences

Interesting Resources:

Small Winds - No. 06

Recent Thoughts and Experiences

Interesting Resources

Small Winds - No. 05

Monthly Thoughts and Experiences

Cool Articles

World Wide CTF 2024 - World Wide Email Search (Web)

4T$ CTF 2024 - My Sky Blog

Small Winds - No. 04

**New Things I learned **

Weekly Thoughts and Updates

BuckeyeCTF 2024 - quotes (Web)

PatriotCTF 2024 - Open Seasame (Web)

Small Winds - No. 03

Weekly Thoughts and Updates

Comparing Link Finder Tools

Comparing Tools to Potentially Finding a CVE

Related CTF Challenge

Web Timing Attacks

A Few Other Notes

Small Winds - No. 02

Weekly Activities and Notes

CTF

Small Winds - No. 01

Weekly Thoughts

BSidesTLV 2024 CTF

Web - Call the Manager pliz!

Radio Frequency - Covert Signal

TBTL CTF Web Writeups

Rnd For Data Science

Butterfly

Large Language Models for CTFs

The Models I Used

The Comparison

Challenges Descriptions for Reference (skip to conclusions if desired)

Conclusions and Final Thoughts

General Impression

Performance By Category

UofTCTF 2024 Writeups

Voice Changer - Web

The Varsity - Web

No Code - Web

Guestbook - Web

Hourglass - Forensics

Flying High - Osint

MetaRed CTF Argentina

Shuffle - Forensics

Extracttheflag! - Web

DEADFACE CTF 2023

Syncopated Beat - Steganography

Tin Balloon - Forensics

Electric Steel - Steganography

UMDCTF 2023

WEB - pop calc

WEB - notsogeo

MISC - ChungusBot v3

Space Heroes CTF

attack-strategies - WEB

Bank-of-Knowhere - WEB

Bynary Encoding - Crypto

Time Leap - Forensics

BDSEC 2022 CTF Writeups

Dominoes (Cryptography - 50 points)

Knight Squad Shop (web - 100 points)

BSidesTLV 2022 CTF - "Medium Expectations"

PortSwigger Labs - Cross-Site Scripting Answers

A Race Against Time

Forgot Password Vulnerabilities

Duolingo - Unlimited XP Points

Simple IDOR With Critical Impact

New Things I learned