Skip to content

Commit 3fab3b6

Browse files
octo-kumoocto-kumo
committed
new
1 parent aae4a58 commit 3fab3b6

File tree

280 files changed

+2663
-751
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

280 files changed

+2663
-751
lines changed

‎2021-appventure-ctf/pwn/Printwriter 1.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
---
2+
ai_date: '2025-04-27 05:10:12'
3+
ai_summary: Format string attack exploited to gain remote shell by replacing '/bin/ls'
4+
with '/bin/sh'
5+
ai_tags:
6+
- fmt-str
7+
- rop
8+
- shell
29
created: 2021-12-21T23:50
310
updated: 2024-06-10T23:38
411
---
@@ -129,4 +136,4 @@ Flag obtained
129136
> cd w
130137
> cat README.txt
131138
> Hello, I was here ;) ZY
132-
> ```
139+
> ```

‎2021-appventure-ctf/web/AppVenture Login Part 0.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,10 @@
11
---
2+
ai_date: '2025-04-27 05:10:15'
3+
ai_summary: Flag found in robots.txt disallowed path pointing to source code
4+
ai_tags:
5+
- robots.txt
6+
- src-code
7+
- 信息披露
28
created: 2021-12-21T23:50
39
updated: 2024-06-10T23:38
410
---
@@ -30,4 +36,4 @@ flag0 = "flag{you_can_use_automated_tools_like_nikto_to_do_this}"
3036
...
3137
```
3238

33-
Flag obtained
39+
Flag obtained

‎2021-appventure-ctf/web/AppVenture Login Part 1.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
---
2+
ai_date: '2025-04-27 05:10:19'
3+
ai_summary: SQL injection vulnerability due to unescaped user input in a query
4+
ai_tags:
5+
- sql
6+
- injection
27
created: 2021-12-21T23:50
38
updated: 2024-06-10T23:41
49
---
@@ -38,4 +43,4 @@ Everything behind `--` is ignored and we successfully log in as admin
3843
flag{you_can_pass_cs6131_now}
3944
```
4045

41-
Flag obtained
46+
Flag obtained

‎2021-appventure-ctf/web/AppVenture Login Part 2.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
---
2+
ai_date: '2025-04-27 05:10:26'
3+
ai_summary: Script bruteforces password by checking characters one at a time using
4+
SQL substring.
5+
ai_tags:
6+
- sql
7+
- brute-force
8+
- sub-string
29
created: 2021-12-21T23:50
310
updated: 2024-06-10T23:38
411
---
@@ -81,4 +88,4 @@ flag{oops_looks_like_youre_not_blind}
8188
flag{oops_looks_like_youre_not_blind}
8289
```
8390

84-
Flag obtained
91+
Flag obtained

‎2021-appventure-ctf/web/Espace 0.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
---
2+
ai_date: '2025-04-27 05:10:32'
3+
ai_summary: Exploited YAML deserialization vulnerability (RCE) in PyYAML 5.3.1 for
4+
remote code execution, using a crafted payload.
5+
ai_tags:
6+
- yaml
7+
- rce
8+
- deserialization
29
created: 2021-12-21T23:50
310
updated: 2024-06-21T21:29
411
---
@@ -63,4 +70,4 @@ And after checking webhook.site for the recieved curl request
6370
flag{yet_another_mal-coded_library}
6471
```
6572

66-
Flag obtained
73+
Flag obtained

‎2021-appventure-ctf/web/Super Secure Trustable Implementation.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
---
2+
ai_date: '2025-04-27 05:10:37'
3+
ai_summary: Bypassed server-side filtering using template string manipulation and
4+
__import__ to execute system command
5+
ai_tags:
6+
- xss
7+
- template-string
8+
- exploitation
29
created: 2021-12-21T23:50
310
updated: 2024-06-21T21:30
411
---
@@ -129,4 +136,4 @@ And after checking webhook.site
129136
flag{server_side_rendering_is_fun_but_dangerous_sometimes}
130137
```
131138

132-
Flag obtained
139+
Flag obtained

‎2022-CDDC/crypto/PaddingOracle/index.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
---
2+
ai_date: '2025-04-27 05:10:43'
3+
ai_summary: Base64-encoded flag input required, likely involving a simple bruteforce
4+
or input validation bypass.
5+
ai_tags:
6+
- base64
7+
- brute
8+
- input-validation
29
created: 2024-06-11T01:17
310
updated: 2024-07-07T23:08
411
---
@@ -36,4 +43,4 @@ $ echo '{flag}' | base64
3643
$ nc 18.141.181.118 8573
3744
Please give me base64 string:e2ZsYWd9Cg==
3845
WYhjrL0sqxSFjvdpzshoA+jPAVLqQj4HHywVKCJdNFyNoYHgCyMjwCsw1mTi0Gbc
39-
```
46+
```

‎2022-CDDC/crypto/Vigenere/index.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,10 @@
11
---
2+
ai_date: '2025-04-27 05:10:45'
3+
ai_summary: Vigenere cipher decryption challenge with key 'key'
4+
ai_tags:
5+
- vigenere
6+
- cipher
7+
- decryption
28
created: 2024-06-11T01:17
39
updated: 2024-07-07T23:09
410
---
@@ -23,4 +29,4 @@ do you know about the vigenere password? if you want to get a flag, you need to
2329

2430
```flag
2531
CDDC22{v3ry_simple_4nd_34sy_crypt0_ch4llenge}
26-
```
32+
```

‎2022-CDDC/forensics/CopynPaste/index.md

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
11
---
2+
ai_date: '2025-04-27 05:10:50'
3+
ai_summary: SVG animation reveals base64-encoded PNG flag after parsing and decoding
4+
ai_tags:
5+
- svg
6+
- base64-decode
7+
- png
28
created: 2024-06-11T01:17
3-
updated: 2024-07-07T23:08
49
title: Copy & Paste
10+
updated: 2024-07-07T23:08
511
---
612

713
The svg is an animation of a terminal window it seems, well a bit of digging and we find this
@@ -43,4 +49,4 @@ It is an PNG image, adding the extension gives us
4349

4450
```flag
4551
CDDC22{S4V4G3_LOVE}
46-
```
52+
```

‎2022-CDDC/forensics/Salad/index.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
---
2+
ai_date: '2025-04-27 05:10:55'
3+
ai_summary: Found hidden data in image by converting to QR code and decoding binary
4+
data
5+
ai_tags:
6+
- qr
7+
- binary-representation
8+
- steganography
29
created: 2024-06-11T01:17
310
updated: 2024-07-07T23:08
411
---
@@ -65,4 +72,4 @@ print(''.join([chr(ord(i) - 3) if i != "{" and i != "}" and i != "_" else i for
6572
RkdHRjU1ezhkT2RnOF9EdTZfajMzZ183X2s2ZG93a30=
6673
b'FGGF55{8dOdg8_Du6_j33g_7_k6dowk}'
6774
CDDC22{5aLad5_Ar3_g00d_4_h3alth}
68-
```
75+
```

0 commit comments

Comments
 (0)