https://omega-coder.github.io/tags/security/ Recent content in security on CHERIEF Yassine Hugo -- gohugo.io en-us Yassine CHERIEF Wed, 24 Apr 2019 00:00:00 +0000 https://omega-coder.github.io/posts/angstromctf-2019-secret-sheep-society-writeup-crypto/ Wed, 24 Apr 2019 00:00:00 +0000 https://omega-coder.github.io/posts/angstromctf-2019-secret-sheep-society-writeup-crypto/ Challenge details Category Points Solves Crypto 120 98 TL;DR Spotting the weakness (AES with CBC Mode). Get token. Flipping specific bytes in session json (turn false to true ). manipulate token with flipped bytes. Send manipulated token to page. Get the flag. Challenge Description The sheep are up to no good. They have a web portal for their secret society, which we have the source for. https://omega-coder.github.io/posts/hacklab-esgi-2019-rookie-web-writeup/ Mon, 08 Apr 2019 10:59:30 +0200 https://omega-coder.github.io/posts/hacklab-esgi-2019-rookie-web-writeup/ Challenge Description Category Points Solves web 100 18 This is the URL for the challenge. URL:http://ctf.hacklab-esgi.org:8082/ So, as soon as we visit the given URL, we get a simple web page saying Website Checker and the title saying super curling (this gonna be fun!!). we notice that there is one input in the page, whatever you give as input gets passed to curl as a parameter. https://omega-coder.github.io/posts/securinets-ctf-2019-lost-flag-writeup/ Tue, 26 Mar 2019 17:37:37 +0200 https://omega-coder.github.io/posts/securinets-ctf-2019-lost-flag-writeup/ Description Category Points Solves Forensics 994 19 Description : Help me get back my flag ! URL: https://web8.ctfsecurinets.com/ After visiting the link above, we get a login page.We can login using admin/admin, but unfortunately the flag is deleted. Then I started searching in the website for any other infos, but with no success. the admin of the challenge (Tr'GFx) said that bruteforcing directories is enough to solve the challenge, so I used dirsearch.