Homemade CTF Challenge: 03 "Web Hunt"

Key Takeaways

Hello everyone. Welcome back. Uh again, my name is John Hammond and I'm in this video I'm showcasing um some more of those challenges that I put together for a local practice exercise CTF or capture the flag competition uh at my school. And so the next challenge was on web hunt. And the prompt here is it's a website scavenger hunt. And the hint that you can find if you hover over is like gre can be an extremely powerful weapon if you know how to wield the sword. So it is a zip file that you'd end up downloading. And once you actually go ahead and use this, you'll notice that it is a full and complete website with an index of HTML and CSS and images and JS and stuff like that. So the ploy is that they would go ahead and and extract all these files and begin to look at the website with a little index.html. I'll drag this down so you can see it. And it is quite simply a website where hopefully it would fool them to like look around and and and and and do things. What you might want to look at the HTML source or some of the CSS. It's literally the ploy is that it's a website scavenger hunt. But since there are a bunch of files and we want to be able to search through them for a flag. Well, at this point we should know the flag format. So what we can do is we can just search for it, right? So that is in the uh web hunts. So that is four in my case. So in the web page or in the website, what we'd end up doing is grepping in our case for anything that starts with USCGA like looking for the flag identifier, the flag format. But we wouldn't want to do it on like a specific file because we know it's probably not going to be in any of those. But we'll do it recursively. - r and we'll look at in this folder onward. So we find it eventually but that uh that d-r folder or that that uh that argument sorry what that does it reads all files under each directory recursively. So that's how I intended them to solve that challenge rather than having to look for it by hand because I actually stored the flagged in the JavaScript like jQuery file. So no one would look through that on their own like individually. The deploy and the hope was that they would use GP to to find it. So GP can of course find the line but and you can you can just go look for it because it'll be highlighted. But a uh a good ploy I think is to now use more things inside of the I think it's RP or O. I want to be able to get just the All right, there it is. Cool. ro o and the regular expressions you find simply the flag itself. So there we go. Grev can find anything if you know what you're looking for. And that is how I ended up putting that together. So the way that I built that was real easy. All I ended up doing was I was taking that nothinginthebox.com and I wget mirrored that to create that nothinginthebox.com. I think I can go ahead and start to show that and then it will no check certificates. Fine. If I need that argument to go ahead and pull it, that's fine. And then it will start to like mirror and scrape the web page. So that's why it was able to create that folder and all the other stuff. So I'll get rid of that. But once it was downloaded, I'd literally just go into the JavaScript file, see what's in there, and I'd go ahead and insert the flag in in the jQuery file. I'd just edit it in like Sublime Text, and just literally plop it in there wherever it's in the middle of a comment or or after a command. So that way it doesn't interrupt the JavaScript code itself, but it's still hidden in in in the web page. So that was it. just using simply GP to find a file, but knowing to use it on all of the files in the web page. So, that was um Did I copy the flag? I want to make sure I copy the flag. Okay, cool. Yep. We'll go ahead and submit it and get our 100 points and we're just moving right along with some of the symbol challenges that I put together for our local practice CTF exercise and competition. So, I'll see you in the next video.