Logged In

Posted by andersongomes001 on December 29, 2018

You may find interesting:


BSides SF 2019 CTF - bWF0cnlvc2hrYQ==


Web

Desafio:

Phew, we totally did not set up our mail server yet. This is bad news since nobody can get into their accounts at the moment… It’ll be in our next sprint. Until then, since you cannot login: enjoy our totally finished software without account.

http://35.207.189.79/

Solução:

É comum encontrar sistemas com comfigurações dafault, e o primeiro usuário que fiz o teste foi o admin.

Branching

Interceptamos o request com Burp Suite.

Branching

A resposta foi um Magic code.

Branching

Agora vamos submeter o Magic code.

Branching

E no Headers podemos ver a flag no Set-Cookie.

Branching

Flag: 35C3_LOG_ME_IN_LIKE_ONE_OF_YOUR_FRENCH_GIRLS