Month: July 2017

hacking, owasp, web application security

OverTheWire: Natas Level 3 – #appsec #webapp #websecurity #wargames

thefluffy007

Another day, anther challenge…

In today’s challenge we will solve level 3 from the Natas wargame. Let’s begin.

Going to the following link, and entering the username of “natas3” and password we retrieved from the second challenge we see:

Natas3_WarGame_1

Password from level 2:

Natas2_WarGame_6

Pressing Enter we see:

Natas3_WarGame_2

Doing a right click, view source we see:

Natas3_WarGame_3

Hmm… we have a hint. “No more information leaks!! Not even Google will find it this time…”

Knowing a thing or two about how Google indexes websites, I know that some websites use a robots.txt file. Let’s see if this website is using that.

Entering “robots.txt” at the end of the URL we see:

Natas3_WarGame_4

OK – the first parameter user-agent specifies that any agent is allowed. We’re disallowing the /s3cr3t/ folder. Let’s go to this folder and see what’s there…

Entering the /s3cret/ folder we see:

Natas3_WarGame_5

Hmm… there’s a users.txt file. Let’s see what’s there.

Natas3_WarGame_6

We found the password for level 4!

hacking, owasp, web application security

OverTheWire: Natas Level 2 – #appsec #webapp #websecurity #wargames

thefluffy007

Another day, another challenge…

In today’s blog post we’re going to solve level 2 from the Natas wargame.

Let’s begin.

Going to the following link we see:

Natas2_WarGame_1

We’ve acquired the password for level 2 from the level 1 challenge (screenshot below):

Natas1_WarGame_3

Entering the username of “natas2” and password from the above screenshot we see the following:

Natas2_WarGame_2

Nothing on the page, eh… I don’t believe that.

Let’s try, right click view source and see what we get.

Natas2_WarGame_3

We notice there’s an image source of a pixel.

Clicking this link we see:

Natas2_WarGame_4

It truly is just a pixel. What if we remove the “pixel.png”? Maybe there are other files on the system. Let’s try it.

Removing the “pixel.png” and pressing Enter we see:

Natas2_WarGame_5

We see an extra file – users.txt. I wonder what’s in it.

Clicking users.txt, we noticed that it lists the different username and passwords. The one we want is the fourth row – natas3. We’ve found natas3 password!

hacking, owasp, web application security

OverTheWire: Natas Level 1 – #appsec #webapp #websecurity #wargames

thefluffy007

Another day, another challenge…

In today’s blog post we’re going to solve level 1 of the Natas challenge.

Let’s begin.

Going to the following URL we see:

Natas1_WarGame_1

From level 0, we were able to find the password of level 1 (screenshot below):

Natas_WarGame4

Entering the username of “Natas1” and password from the screenshot we see:

Natas1_WarGame_2

Looking at the message we noticed that right-clicking has been blocked. How can we get around this?

By adding “view-source” in the beginning of the URL.

Doing this we see:

Natas1_WarGame_3

We’ve acquired the password for level 2!

hacking, owasp, web application security

OverTheWire: Natas Level 0 #appsec #webapp #websecurity #wargames

thefluffy007

Another day, another challenge…

Today’s challenge we’re going to solve the first level of the Natas wargame challenge.

Let’s begin.

Going to the first level, we see the following:

Natas0_WarGame

Entering the URL we see the following prompt:

Natas0_WarGame2

Entering the username and password of “Natas0” we see the following:

Natas_WarGame3

Doing a right click, and selecting “View Page Source” we see:

Natas_WarGame4

We found the password for natas1! We’ll solve that challenge in the next blog post…

Uncategorized

PicoCTF 2017 – A Thing Called A Stack #ctf #picoctf #appsec #infosec #reverseengineering

thefluffy007

Another day, another challenge.

In today’s blog post we’re going to solve the “A Thing Called A Stack” challenge from PicoCTF.

Let’s get started.

Clicking on the challenge, we see the following:

PicoCTF_A_Thing_Called_A_Stack_1

OK, so we’re given a file, and we need to determine the difference between the value of esp at the end of the code, and the location of the saved return address.

Looking at the hints we see the following:

PicoCTF_A_Thing_Called_A_Stack_2

We’ve encountered two different questions. Where is the return address saved, and what commands actually affect the stack.

DISCLAIMER: I haven’t worked with assembly in probably 8 years. So, what did I do? Go to YouTube.

Entering – “Assembly tutorial” I found a GREAT crash course on explaining assembly.

I have linked the video here.

Opening the file (Notepad++ is great!)

We see the following:

PicoCTF_A_Thing_Called_A_Stack_3

Using the YouTube tutorial, let’s decode the assembly code.

First we’re pushing the ebp (base pointer) onto the stack.

Next, we move the esp (stack pointer) to be at the same location to the base pointer.

Next, we push edi, esi, and ebx onto the stack. Note these instructions don’t change the stack. This solves question #2 in the hints section.

Next, we add 180 (0xb4 hex) to the stack to hold local variables.

Next, we’re going to store the local variable x = 0, to address 180 + 4 = 184

Next, we’re going to store the local variable y = 1,  to address 184 + 4 = 188

Next, we’re going to store the local variable z = 2, to address 188 + 4 = 192

Next, we’re going to store the local variable a = 3, to address 192 + 4 = 196

So now the esp (stack pointer) is now at 196.

Let’s convert 196 to hexadecimal.

Doing this we get the following: 0xc4

Entering this into the challenge, we see that solved the challenge and acquired 60 points!

capture the flag, hacking

PicoCTF 2017 – Special Agent User #appsec #infosec #forensics

thefluffy007

Another day, another challenge.

Today’s blog post we will solving the “Special Agent User” challenge in the PicoCTF.

Let’s get started.

Clicking on the challenge we see:

PicoCTF_Special_Agent_1

We have another pcap (packet capture file) and we need to find the User Agent. OK. Sounds plausible. Let’s look at the hints.

PicoCTF_Special_Agent_2

There’s a link that discuss more about user-agents. Let’s go to that link.

Opening that link we see the following:

PicoCTF_Special_Agent_3

The web page explains the different components of the User-String. This will be useful.

Opening the packet capture file we notice the usual stuff UDP, and ICMP packets. And like with the first “Digital Camouflage” challenge we can ignore this.

User-Agent strings are found in HTTP requests. We need to look at packet captures for just HTTP requests.

Doing this we see a packet that’s piqued our interest…

PicoCTF_Special_Agent_4

On packet 80 (GET / HTTP/1.1) we’ll do a right click, Follow, HTTP stream.

Doing this we have the following:

PicoCTF_Special_Agent_5

Looking at the last entry in the user agent, we can see that the packet is using Firefox 25. Entering that as the flag, we’ve acquired 50 points!

capture the flag, hacking

PicoCTF 2017 – computeAES #infosec #appsec #crypto #ctf

thefluffy007

Another day, another challenge.

Today’s blog post will explore solving the “computeAES” challenge in PicoCTF.

Let’s get started.

Clicking on the challenge we see the following:

PicoCTF_computeAES_1

Clicking on the clue link we see the following:

PicoCTF_computeAES_2

Going back to the challenge and clicking the hints we see:

PicoCTF_computeAES_3

Let’s use the hint of using online tools to solve this challenge.

Doing a Google search for “convert base64 to hex” we get the following link.

Going to this link we put in our base64 input to get the hex equivalent.

Doing this for the key and the input we get the following:

Key = 4f9b95cd8b6e04dbfabf08e886c955e3

Input = b75874a9b70e851405e44e3a6ec34b8a67db708e9e82b28fe0b1ed291de54f851d5a386cb0cf11412053ed2ffcadc472

Doing another Google search for “AES calc hex” we get the following link.

Entering the hex value of the key and input we get the following:

PicoCTF_computeAES_4

We found the flag! Copying the flag and removing the extra space we’ve acquired 50 points!

capture the flag, hacking

PicoCTF 2017 – Yarn #appsec #infosec #ctf

thefluffy007

Another day, another challenge…

Today’s blog post we will solve the, “Yarn” challenge from PicoCTF.

Let’s get started.

Clicking on the challenge we see:

PicoCTF_Yarn_1

OK, we need to find a flag inside of a file, but we do not know what the file is.

Let’s look at the hints and see if that provides any clues.

PicoCTF_Yarn_2

Looking at the hints we’re provided with two questions. Possibly answering these questions will leads us to the flag.

Answer question #1 – “what does the string command use to determine if something is a string?” We decide to do a Google search to answer just that.

Doing this Google search we’re provided with the following link.

Reading the article we determine that the strings command prints the printable characters from a file.

Doing that we’re provided with the following screenshot:

PicoCTF_Yarn_3

We’ve answered question #1. Let’s answer question #2.

Question #2 – is there a way to change the length that the strings command look for?

Going back to the link we see that there is a way we can specify that there is a way to determine the length of strings we want to print.

How do we use this?

By adding the “-n <length you want to use>”

Doing this we get the following:

PicoCTF_Yarn_4

Scrolling down we see:

PicoCTF_Yarn_5

Hmm… I think we found the flag! “Submit_me_for_I_am_the_flag”

Putting this string as the flag we have acquired 55 points!

capture the flag, hacking

PicoCTF 2017 – Meta Find Me #appsec #infosec

thefluffy007

Another day, another challenge.

Today’s blog post is solving the, “Meta Find Me” challenge within PicoCTF.

Let’s get started.

Clicking on the challenge we see:

PicoCTF_Meta_Find_Me_1

OK, we need to find meta data inside of an image. Let’s see what the hints give us.

PicoCTF_Meta_Find_Me_2

We need to answer the question of how location is stored in imaged. Look like Google will once again be our friend đŸ™‚

After downloading the image, and doing a Google search of, “GPS info on photos” we’re presented with the following link.

Reading the link (which is from How-To-Geek) we learn that if we look at the properties of a image it will give the GPS coordinates.

OK, that’s a start.

While continuing reading the article we notice that with these type of images there’s an embedded EXIF data in the image.

Let’s try a Google search of “EXIF GPS decrypter” and see if we can view the embedded EXIF data for our image.

Doing that Google search we’re presented with the following link.

Going to that link, and uploading our image and click the “view EXIF” button we’re presented with the following:

PicoCTF_Meta_Find_Me_3

Looking at the comment we see that part of the flag is present, we need to find the latitude and longitude. Luckily that’s presented above the comment.

Entering the flag we’ve acquired 70 points!

capture the flag, hacking

PicoCTF 2017 – Hash101

thefluffy007

Another day, another challenge.

Today’s blog post will be solving the “Hash101” challenge from the PicoCTF.

Let’s get started.

Clicking on the challenge we see…

PicoCTF_Hash101_1

OK we need to hashes to claim our flag. Let’s see what the hints say.

PicoCTF_Hash101_2

Looking at the hints Google will be our friend đŸ™‚

Connecting to the server we see:

PicoCTF_Hash101_3

We need to convert the binary to ASCII text.

Doing a Google search of, “binary to ASCII text converter” search we get the following website.

Going there, we see:

PicoCTF_Hash101_7

Changing the binary to the binary in the challenge we get:

PicoCTF_Hash101_8

The text we’re looking for is “peace” entering this in we are now in the second level of the challenge.

PicoCTF_Hash101_11

We need to find the hex value of our word, peace. Going back to the link referenced above, we see that the hex is referenced.

PicoCTF_Hash101_12

Entering that we now need to enter the decimal equivalent. For this, going back to Google and entering “hex to decimal converter” we get the following link.

Clicking the link we see:

PicoCTF_Hash101_9

Entering the hex value we get the following decimal value.

PicoCTF_Hash101_10

Entering that into the challenge we get the following:

PicoCTF_Hash101_13

Going to the third level we see:

PicoCTF_Hash101_14

Reading the description one might ask, what are we looking for?

Remember from the first level of the challenge where we need to find the ASCII text?

Doing a Google search of, “ASCII table” we find the following link.

Opening the link we see the ASCII equivalent of the letters.

We need to find a string that when doing the modulo of base 16 we get a number of 10.

One might wonder… what is modulo?

The modulo is the remainder of a division equation.

We know that we are dividing by 16 and the modulo (remainder) needs to be 10.

One way to achieve this is to find any multiple of 16 and add 10.

Why multiple of 16? Doing a multiple of 16 if we did a modulo of that the modulo would be 0 (as there is no remainder).

Doing this I was able to do the following:

PicoCTF_Hash101_5

Entering 4, we had a module of 4 and not 10.

Entering the string of “:” we were able to complete the level. Why? “:” in ASCII is 58. How did we get 58? 16 * 3  = 48 + 10 = 58. We’re adding 10 because we know we need a remainder of 10.

Moving to level 4 we see:

PicoCTF_Hash101_15

Doing another Google search of, “MD5 decrypter” we get the following link.

Clicking the link and entering the md5 hash, we get the following:

PicoCTF_Hash101_16

Entering this the level we see:

PicoCTF_Hash101_17

Entering this flag into the input box we’ve acquired 50 points!