CTFs

Room / Challenge: Mango (Web) Metadata Author: jameskaois CTF: DreamHack Challenge: Mango (web) Link: https://dreamhack.io/wargame/challenges/90 Level: 2 Date: 07-11-2025 Goal Get the flag by leveraging blind NoSQL Injection. My Solution You can download and examine the source code here. The web app just have one main.js file to examine: const express = require('express'); const app = express(); const mongoose = require('mongoose'); mongoose.connect('mongodb://localhost/main', { useNewUrlParser: true, useUnifiedTopology: true, }); const db = mongoose.connection; // flag is in db, {'uid': 'admin', 'upw': 'DH{32alphanumeric}'} const BAN = ['admin', 'dh', 'admi']; filter = function (data) { const dump = JSON.stringify(data).toLowerCase(); var flag = false; BAN.forEach(function (word) { if (dump.indexOf(word) != -1) flag = true; }); return flag; }; app.get('/login', function (req, res) { if (filter(req.query)) { res.send('filter'); return; } const { uid, upw } = req.query; db.collection('user').findOne( { uid: uid, upw: upw, }, function (err, result) { if (err) { res.send('err'); } else if (result) { res.send(result['uid']); } else { res.send('undefined'); } }, ); }); app.get('/', function (req, res) { res.send('/login?uid=guest&upw=guest'); }); app.listen(8000, '0.0.0.0'); We have to leverage /login route to get the flag. There is a filter function that prevents us from use admin, dh and admi in the route. For example, when we visit /login?uid=admin&upw=DH{ received filter: ...

Room / Challenge: Secure-Letter (Web) Metadata Author: jameskaois CTF: QnQSec CTF 2025 Challenge: Secure-Letter (web) Target / URL: http://161.97.155.116:3001/ Points: 50 Date: 20-10-2025 Goal We have to get the flag by using XSS to get the flag from bot. My Solution This solution is written after the server has beed shut down, so I will use my mind. First let’s examine the source code, there is a route that we can use to inject Javascript code (XSS): /letter route ...

Room / Challenge: s3cr3ct_w3b revenge (Web) Metadata Author: jameskaois CTF: QnQSec CTF 2025 Challenge: s3cr3ct_w3b revenge (web) Target / URL: http://161.97.155.116:8088/ Points: 50 Date: 20-10-2025 Goal We have to get the flag by leveraging XML viewer. My Solution Examine the source code, the source code is written in PHP however examine the Dockerfile, unlike s3cre3ct_web the DockerFile now is different: FROM php:8.2-apache RUN docker-php-ext-install pdo pdo_mysql RUN a2enmod rewrite COPY public/ /var/www/html/ RUN mkdir -p /var/flags && chown www-data:www-data /var/flags COPY flag.txt /var/flags/flag.txt WORKDIR /var/www/html/ EXPOSE 80 The flag.txt file is copied to /var/flags/flag.txt so we cannot access it like the s3cre3ct_web challenge anymore. ...

Room / Challenge: s3cr3ct_w3b (Web) Metadata Author: jameskaois CTF: QnQSec CTF 2025 Challenge: s3cr3ct_w3b (web) Target / URL: http://161.97.155.116:8081/ Points: 50 Date: 20-10-2025 Goal We have to get the flag by finding the secret. My Solution Examine the source code, the source code is written in PHP however examine the Dockerfile, we can find something really “secret”: FROM php:8.2-apache RUN docker-php-ext-install pdo pdo_mysql RUN a2enmod rewrite COPY public/ /var/www/html/ COPY includes/ /var/www/html/includes/ COPY flag.txt /var/www/html/ WORKDIR /var/www/html/ EXPOSE 80 The flag.txt file is copied to /var/www/html where it is normally served. So we can easily get the flag by visiting http://161.97.155.116:8081/flag.txt. ...

Room / Challenge: QnQSec Portal (Web) Metadata Author: jameskaois CTF: QnQSec CTF 2025 Challenge: QnQSec Portal (web) Target / URL: http://161.97.155.116:5001/ Points: 50 Date: 20-10-2025 Goal We have to get the flag by get access as admin. My Solution First we have to examine the app.py. There are some noticable routes: /login route: @app.route('/login', methods=['GET', 'POST']) def login(): if request.method == 'GET': return render_template('login.html') username = (request.form.get('username') or '').strip() password = request.form.get('password') or '' if not username or not password: flash('Missing username or password', 'error') return render_template('login.html') db = get_db() row = db.execute( 'select username, password from users where username = lower(?) and password = ?', (username, md5(password.encode()).hexdigest()) ).fetchone() if row: session['user'] = username.title() role = "admin" if username.lower() == "flag" else "user" token = generate_jwt(session['user'],role,app.config['JWT_EXPIRES_MIN'],app.config['JWT_SECRET']) resp = make_response(redirect(url_for('account'))) resp.set_cookie("admin_jwt", token, httponly=False, samesite="Lax") return resp flash('Invalid username or password', 'error') return render_template('login.html') /account route: ...

Room / Challenge: A Easy Web (Web) Metadata Author: jameskaois CTF: QnQSec CTF 2025 Challenge: A Easy Web (web) Target / URL: http://161.97.155.116:5000/ Points: 50 Date: 20-10-2025 Goal We have to get the flag by guessing the UID to gain access as admin. My Solution This is an easy challenge however we need to do some guessing and hope for luck. The description of the challenge is: This is the web I mad for testing but I don’t know if there anything strange can you help me figure out? We need to find something strange in the website to leverage it and gain access as admin. Let’s visit the page: ...

Room / Challenge: Wave Second For Git (Misc) Metadata Author: jameskaois CTF: WannaGame Freshman CTF 2025 Challenge: Wave Second For Git (Misc) Difficulty: Medium Points: 451 Solves: 8 Date: 06-10-2025 Goal We have to get the flag by using Git cli. My Solution Here is the source, you can download it here There is the flag.txt with this content: VzF7ZzF0aHViXw== It is encoded with base64 algorithm, it is easy to decode it, result is the first part of the flag: ...

Room / Challenge: Open Read Flag (Web) Metadata Author: jameskaois CTF: WannaGame Freshman CTF 2025 Challenge: Open Read Flag (web) Target / URL: http://61.28.236.247:10000/ Difficulty: Medium Points: 484 Solves: 5 Date: 06-10-2025 Goal We have to get the flag by leveraging the view file functionality. My Solution Here is the source code, you can download and examine it here The website is simple with just a read file functionality. ...

Room / Challenge: Admin Tồi (Web) Metadata Author: jameskaois CTF: WannaGame Freshman CTF 2025 Challenge: Admin Tồi (web) Target / URL: http://61.28.236.247:9000/ Difficulty: Medium Points: 419 Solves: 10 Date: 06-10-2025 Goal We have to get the flag by leveraging the vuln in authentication feature My Solution Here is the source code, you can download and examine it here This is the home page of the website. Let’s try creating an account and logging in to it to see what we got. ...

Room / Challenge: Intergalactic Webhook Service (Web) Metadata Author: jameskaois CTF: SunShine CTF 2025 Challenge: Intergalactic Webhook Service (web) Target / URL: https://supernova.sunshinectf.games/ Difficulty: Easy Points: 10 Date: 01-10-2025 Goal We have to get the flag by leveraging the vuln in webhook service. My Solution Here is the source code, you can download it here. The backend has this vulnerable code: def is_ip_allowed(url): parsed = urlparse(url) host = parsed.hostname or '' try: ip = socket.gethostbyname(host) except Exception: return False, f'Could not resolve host' ip_obj = ipaddress.ip_address(ip) if ip_obj.is_private or ip_obj.is_loopback or ip_obj.is_link_local or ip_obj.is_reserved: return False, f'IP "{ip}" not allowed' return True, None This code takes the URL, if hostnames -> IP address using the DNS. If IP is private (like 192.168.x.x), loopback (127.0.0.1) it will be blocked. ...