lavafroth

The challenge This is a web challenge involving javascript, meaning most of the solution is going to be client side.

This is a web exploitation challenge from 2021.

This writeup is rather haphazard as I jumped around from one place to another solving different unrelated challenges.

This challenge gives use two images and asks us if we can make a flag out of them.

This challenge asks for python code as an input, converts it into an AST (abstract syntax tree) and if there aren’t any function calls or imports, executes the code.

Introduction This challenge asks us to connect to an webpage with a base64 encoded message.

In this RingZer0 challenge, we are to visit the challenge url where we are given 2 seconds to SHA512 hash the message represented by the binary provided string.

In this RingZer0 challenge, we are asked to visit http://challenges.ringzer0team.com:10013/ and are given 2 seconds to hash the provided message using the SHA512 algorithm.

Introduction Despite its infamy for profanity and dark, satiric humor, I’ve been a huge fan of South Park over the years.

The challenge Logging into the box we are told that the flag is located at /home/level3/flag.txt. function check_space { if [[ $1 == *[bdksc]* ]] then return 0 fi return 1 } while : do echo "Your input:" read input if check_space "$…

The challenge Logging into the box we are told that the flag is located at /home/level2/flag.txt Challenge bash code function check_space { if [[ $1 == *[bdks';''&'' ']* ]] then return 0 fi return 1 } while : do echo "Your input:" read input if…

The challenge Upon SSHing into the box, we are told that the flag is located at /home/level1/flag.txt Challenge bash code: while : do echo "Your input:" read input output=`$input` done Inference and experimenation The script is reading an input, exec…

I’m a self taught programmer and a digital artist.

A painting of the lead vocalist of Twenty Øne Piløts, named after one of my favorite songs from their album Vessel.

Clearly the title was an afterthought.

In this post, we’ll walk through the Operation Oni and Operation Orchid challenges from the PicoCTF competition held in March 2022.

The challenge description states that most web application developers use third party components without testing their security.

The idea is simple: Remove all duplicates, including zero length files Fine tuning: Hand-pick and remove files deemed unnecessary Since the mileage for second step might vary from person to person, I’ll elaborate on the first step.

At first glance the webapp looks like a stripped down version of Pastebin where we can post a text / code snippet.

We’ve all been there.