BuckeyeCTF 2024 - SSFS

Page Source Inspection The actual functionality of uploading and downloading files weren’t working so I looked at the page source. I saw this portion of the source: const searchFile = async () => { let formData = new FormData(searchForm); console.log([...formData][0]); let response = await fetch('/search/' + [...formData][0][1], { method: 'GET', }); searchWrapper.hidden = false; if (response.status === 200) { searchMessage.innerHTML = 'File found. Download link: <a href="/download/' + [...formData][0][1] + '">Download</a>'; } else { searchMessage.innerHTML = 'File not found.'; } } If we look closer, once a file is found from the search bar (or the search functionality), there will be a linked provided by the site that accesses the path of that file: ...

October 7, 2024 · Joon Kim

tamuctf 2022 - Lockout

taumf2022: lockout Author: SwitchBlade I seem to have locked myself out of my admin panel! Can you find a way back in for me? Do not connect with HTTPS, make sure to connect with HTTP Link: http://lockout.tamuctf.com Solve I couldn’t solve this one so I referred to this https://www.youtube.com/watch?v=f198HnqCwng&t=206s video. When you attempt to login to the blog, the page gets redirected back to the login page right away because of the 302 response. ...

April 22, 2022 · Joon Kim