2013 – Tunelko. Random (in)security.

Preventing ‘SQLi’ Cheatsheet during attack-defense CTF (Basic approach)

This document explains how to prevent, in several ways, SQLi attack. We can patch this lines as examples below, if we found vulnerable PHP sentences during attack-defense CTF. Of course, it depends on the way they use PHP and there’s…

CTF Wargame XSS

XSS Challenges

Here's my journal to solve all the XSS Challenges writed by yamagata21 on http://xss-quiz.int21h.jp/, This is an starter level to people who want to learn some cross-site scripting and its several ways to inject on differents browsers. XSS Challenges http://xss-quiz.int21h.jp Stage1: http://xss-quiz.int21h.jp…

CTF Wargame

NotSoSecure SQLi CTF – writeup

Access to challenge using a proxy like burp or zap and submit data to login. Notice the forwarded to: http://ctf.notsosecure.com/71367217217126217712/checklogin.php that contains: 7365637265745f72656769737465722e68746d6c This could be decoded '7365637265745f72656769737465722e68746d6c'.decode('hex') in python to read secret_register.html >>> '7365637265745f72656769737465722e68746d6c'.decode('hex') 'secret_register.html' The registration page offers…

CTF Reversing Wargame

Format string attack. Introduction.

On this post we are going to learn more about format string attacks. On Internet you can find a lot of resources talking about the topic, so this is another one. What is a format string and how to recognize…

CTF Wargame

ASIS CTF – simple pcap «spcap» writeup

A simple task named spcap (simple pcap). We open it with wireshark and get the Statistics->Conversations. Some SSH, HTTP on it. Apply this filter on HTTP: ip.addr==172.16.133.133 && tcp.port==52694 && ip.addr==172.16.133.149 && tcp.port==80 We notice that if we follow TCP…