picoCTF Web Exploitation Challenges and Solutions

This challenge is about web exploitation. The challenge involves reading and altering the request and response. A website link is given in the challenge and in that website there are two choices of red and blue. Selecting either of them changes the color of the body tag based on selection. The challenge is to find the flag being held on this server.

If you look at the source code of website, It's a simple template using Bootstrap CSS. No javascript or custom CSS stylesheet is attached in the HTML code. So it tells us there is no room for secrets or surprises. I tried all sorts of variations while selecting red and blue buttons but no luck. Then I come to realize that maybe the answer is in the request and response header itself. The second hint also verifies it while referring to the use of burpsuite.

I have never used Burpsuite before this challenge. So I went to their website and somehow decided to use Dasterdly. It's their lightweight containerized application that scans web applications for security vulnerabilities. Going through the documentation, I found this command to check security vulnerabilities in the target website:

docker run --user $(id -u) --rm -v $(pwd):/dastardly -e DASTARDLY_TARGET_URL=http://mercury.picoctf.net:15931 -e DASTARDLY_OUTPUT_FILE=/dastardly/dastardly-report.xml public.ecr.aws/portswigger/dastardly:latest

By passing the challenge-given URL in the target URL, this docker command runs the container and scans the website for security. I checked the report but it did not point me anywhere. So, after the first setback, I decided to try a different approach which is to use the correct burp suite tool.

I download and install Burp Suite Community Edition tool on Windows system. This tool is used to manipulate requests made to the server. It is actually the recommended tool by the second hint that I should have used in the first place.

• Open Burp Suite Community Edition, start a temporary project and select 'Proxy' from the options. While keeping the intercept off, click on 'Open browser' to launch the burp browser for testing.
• Open the challenge website http://mercury.picoctf.net:15931/ in burp browser and turn on the intercept option. Now the request to the server will be held hostage by burp suite proxy and forwarded manually after analyzing or modifying the HTTP request.
• Refresh the webpage and change HTTP request attributes as per need. Then click on forward to send the modified request to the server and see the response returned by the server by checking Network tab in inspect mode.
• We can also check response headers in the burp suite. After opening the burp suite temporary project, select option 'Target'. Select 'Open browser' to launch the burp browser and open any website. Burp suite target will capture that HTTP requests header. Send this captured request to 'Repeater' by right click and selecting 'Send to repeater'. Now select option 'Repeater' instead of 'Target' and modify the request headers. After altering the request, Send it to the server and inspect the response in 'Inspector' panel on the right.

Now while manipulating HTTP requests to the server, I tried almost all alternative values for headers and so far nothing turned out to be good. Then I realize that in the HTML code, there are two forms. Form handling the red color has 'GET' method while form handling the blue color has 'POST' method. In the challenge heading, It says GET aHEAD and it became all crystal clear.

I capture the HTTP request using burp suite, modify the method from POST to HEAD, and forward the modified HTTP request to the server. Now check the 'Response Headers' in 'Network' tab under 'Inspect' and you will find your flag:

It worked for both Red and Blue form requests. Just make sure 'Network' tab is opened while forwarding the modified HTTP request to the server.

Alternate Solution:

Method 1: Now after understanding the challenge, I came up with an easy Python script that modify HTTP request header to get our flag. Just use the below script and It's done:

import requests

url = 'http://mercury.picoctf.net:15931/'
response = requests.head(url)
print(response.headers)

Method 2: If you want to make it super easy to check HTTP header request and grab flag, run this single command and the flag is yours:

curl -I HEAD http://mercury.picoctf.net:15931/

This linux command will output the HTTP header response that contains the flag. These are couple of methods that can be used to reveal the flag from the given challenge url.

This challenge is about cookies. Cookies are typically saved in our web browser and used for various purposes. There are actually several types of cookies and based on that, each type of cookie server different purpose. The best part is that we can specify cookies in HTTP request headers while making a custom request to the server. This challenge falls into this category.

Below is the Python script that can be used to get the flag but first you need to install bs4 and requests python pip pakages. Use the below command to install these required packages:

pip install requests beautifulsoup4

Instead of running a python script, you can also use this Bash script in Linux terminal to get the flag:

for i in {1..20};do curl -X GET -H "Cookie: name=$i" http://mercury.picoctf.net:21485/check;done | grep "<b>"

We are given URL http://mercury.picoctf.net:21485/ and the challenge is to find the flag in it. After running the URL in the browser, you'll notice that it takes user input. The placeholder of input field is 'snickerdoodle' and if we search using 'snickerdoodle', we get the message saying 'I love snickerdoodle cookies!' and an alert saying 'That is a cookie! Not very special though...'.

Now there is no hint given in the challenge. But this placeholder is actually a hint itself. There is no HTTP cookies named 'snickerdoodle' but it's actually a real cookie that we eat. So the hint is to try eatable cookies in the search field. I did find two more cookies which are shortbread and biscotti. After trying them, I got the same message and alert. This means they are not the right cookie either.

There could be hundreds of eatable cookies and we simply can't find their names and try each of them manually. So i opened http://mercury.picoctf.net:21485/ URL in Burp Browser using 'snickerdoodle' in the input field. While trying to capture and modify cookies from the HTTP request header, I notice that after clicking on search, two requests were made to the server. One is POST request to the PATH '/search' and other one is GET request to PATH '/check'. In POST request headers, I changed the cookie attribute from Cookie: name=-1 to Cookie: name=1 and then forward the request. After forwarding, burp captured the GET request. After changing the value from Cookie: name=0 to Cookie: name=1 and forward the request, I got this message:

Now if you noticed, I input 'snickerdoodle' in the input field. Getting 'chocolate chip' instead of 'snickerdoodle' verifies that our HTTP request headers modification method works. But this cookie is also not the correct cookie. So I repeat the process and this time I used Cookie: name=2 in cookie modification. And I got this message:

Now we know the process to extract our flag from challenge website. We have to try each number in 'Cookie: name=' from 1 to until we get the flag. But It's not a good idea to manually modify cookies in HTTP request headers because we don't know how far we have to go. The flag might be at 'Cookie: name=50' or 'Cookie: name=70' and we cannot explore each number manually. I mean we can but It's not ideal to go through each number.

So to ease the process, I have written a Python script and Bash script. Use any script that you want. Both scripts iterate through numbers 1 to 20 while modifying the HTTP request headers and forwarding them to the server.

This challenge provides two website links. Both links lead to the same server so you can use any link you want. The goal is same as always, find the flag. This challenge will be like 'walk in the park' for you if you know a little bit of inspecting in web browser.

Below is the Python and Bash script that can be used to extract the flag. For Python script, requests pip package is required. Use pip install requests command to install the package.

This challenge provides different types of URLs but they all lead to the same server. We will be using URL http://jupiter.challenges.picoctf.org:9670 and the challenge is to find the flag in it. After running the URL in the browser, you'll notice that it only has two options: What and How. The heading of webpage says: Inspect me and that's what need to do.

The flag for this challenge is scattered in three parts. This webpage is constructed with HTML, CSS, And JS files.

• First part of flag is inside the HTML file. Right-click on webpage and select 'View Page Source' and you can the first part of flag at the bottom of HTML page.
• Second part of the flag is in the CSS file. Add '/mycss.css' at the end of URL to see CSS file content in the browser. And you can find the second part of flag at the bottom of CSS file.
• Third part of the flag is in the JS file. Add '/myjs.js' at the end of URL to see Javascript file content in the browser. And you can find the third and final part of flag at the bottom of JS file.

Combine these parts into a single line and that's your flag: picoCTF{tru3_d3t3ct1ve_0r_ju5t_lucky?2e7b23e3}

This challenge is somewhat similar to the previous one but a little bit confusing because it explores different OS. A link is give and the task is to find the flag.

This challenge provides a URL that gives information about It's usage of HTML, CSS, and JS. The flag is scattered in five parts. Just like previous challenge, you need to 'View Page Source' these pages and files to access the particular part of flag.

• Flag part 1: First part of flag is in the HTML file. 'View Page Source' the homepage and you will get the flag part at the bottom of the page.
• Flag part 2: Second part of flag is in the CSS file. By going to http://mercury.picoctf.net:27393/mycss.css, we can get the flag part at the botton of CSS file.
• Flag part 3: For third part, take a look at the JS file. By going to http://mercury.picoctf.net:27393/myjs.js, you will get hint for the next part of flag. Basically the hint points towards robots.txt file. This file specifies the rules for web crawlers and instructs web crawlers to access or not access a certain webpage. By going to http://mercury.picoctf.net:27393/robots.txt, we can get the flag part from the robots file.
• Flag part 4: In the robots file, you'll get another hint for the next part of flag. It point towards .htaccess file, which is a per-directory configuration file for Apache web server that is used to override server settings in the context of a specific directory. By going to http://mercury.picoctf.net:27393/.htaccess, we can get the flag part from the .htaccess file.
• Flag part 5: For the last part, hint points towards the MAC. And due to my interaction with MAC, I could not find the solution. So the credit for last part of flag goes to this Github Article. It turns out that MAC has hidden .DS_Store file in each directory that contains custom attributes of icons, metadata, etc. This file can also be copied to the server while transferring website files from the local server to the remote server. So basically, by going to http://mercury.picoctf.net:27393/.DS_Store,we can get the final part of flag.

Combine all the five parts and you will get your flag: picoCTF{th4ts_4_l03s_2_lO0k_d375c750}. You can also use the Bash script provided above to automate the process of extracting and combining flag from all different pages and files.

This challenge does not provide any description. Just a link and the goal is same as always, to find the flag.

curl -sS http://mercury.picoctf.net:15472/JIFxzHyW8W|grep -a pico

This challenge does not provide any hint or description. After opening the link, there is not much going on except the input box and submit button. If you 'Inspect' the webpage and under 'Network' tab, there are three files.

The first one is the index.html file, second is the Javascript file, and third file comes under suspicion because It's not being used anywhere. After Preview this file, you'll know that It's a binary file.

You can find the flag at the bottom of this file. picoCTF{c733fda95299a16681f37b3ff09f901c} is the flag for this challenge.

This challenge is a little bit tricky. The link provided in the challenge leads to a webpage that can only reveal flag if the user is an admin. But there is not login form. This webpage uses cookies to consider the user a normal user or an admin. We just need to find the appropriate admin cookies.

This challenge is all about finding the right cookies. If you look at the first hint, It's about Homomorphic Encryption which is a cryptography technique that allows computations to be performed of the encrypted data without decrypting it and the result of that computations will also be in encrypted form. There are three types of Homomorphic Encryption schemes: Partially Homomorphic Encryption, Somewhat Homomorphic Encryption, and Fully Homomorphic Encryption.

In the challenge description: I forgot Cookies can Be modified Client-side, so now I decided to encrypt them!, letter C and B are capitalized which means they hint towards something. Turns out there is an mode of operation used in encryption named Cipher Block Chaining (CBC). In our case, it looks like CBC is used to encrypt block of data under partially homomorphic encryption scheme.

After some reading about CBC, you might find that It's vulnerable to Bit-flipping attack. You can use above Python script to reveal the flag. Below is the explanation of that code:

• First, we grab the cookies from the webpage and then decode the cookie to Its binary representation using base64. Then further decode the decoded cookie using base64 to turn it into bytes form.
• In function, exploit, two 'for' loops are performed. To revise the basics, every byte have 8 bits. So the first loop will select a byte and second loop will flip the bit from the selected byte, by 8 times. Every time a bit is flipped, a new encrypted cookie is constructed and a request is made to http://mercury.picoctf.net:56136/ using that cookie to check if that's the correct admin cookie.
• If that constructed cookie is the correct admin cookie, It'll reveal the flag. Otherwise, loop will continue to the last byte until flag is revealed.
• The constructed cookie will only change a single byte at a time. Bytes before and after that changed byte remain the same.

In the end, you'll see a similar message where you can see the flag picoCTF{cO0ki3s_yum_e491c430}. It also shows which byte was carrying the admin bit that we flipped and the constructed cookie.

Admin bit found in byte 9 bit 0
Flipped bit worked: b'o\xc7I\xbc\x12\rx\x08\xba\xcc'
Constructed cookie: YjhkSnZCSU5lQWk2ektSTDB5OVNoTzNYWHU5d2tHNUhUK2VmRmY2ZlhWWE92aTlrU1JKcy8vTStyTVhJVGxackRNZTFRUTkxTHFnR1NvYzFxMVdrakJ0S0oyZEdFMkZ3VXJIVFdoWUtJMk9YR0QwUDNla3l2N3VZTXl5MUlFemo=
Flag: picoCTF{cO0ki3s_yum_e491c430}