tl;dr

• Use DNS Rebinding attack to read flag from /flag endpoint.

tl;dr

• Bypass nginx’s DENY ALL using SCRIPT_NAME
• Calculate key_id uploading flag.txt.enc
• Leak the key and decrypt flag.txt.enc

tl;dr

• use hash extension to bypass password check on login.
• use RSA properties to recover $q$ and get $p$ and therefore $N= p*q$.
• sign the message given, and get the flag.

tl;dr

• XSS using DOM Clobbering
• <a id="showInfos"></a><a id="SETTINGS" name=check data-timezone="aaa" data-location="eval(window.name)"><a id="SETTINGS" name="x">
• Bypass CSRF protection to execute XSS and read flag.

tl;dr

• Multiplying the middle element of 3x3 matrix with 9 gets thesum of all elements.
• Adding the least element of 5x4 matrix with the larget and multiplying this result by 10 gets the sum of all elements.
• multiplying any row with 2000 and subtrating that number by 2 will get you the sum.
• Remaing two rows can be filled with the result of subtracting 9 from each digit of a corresponding row .

tl;dr

• Create a Linux profile for Ubuntu 18.04 (5.4.0-42-generic) in Volatility
• Use linux_bash plugin to get link to the repo and linux_find_file plugin to recover the filepath
• Decode the keyboard stream data to retrieve the flag

Official writeup of Crypto challenge “Tabula Recta” from InCTFi 2021

tl;dr

• Retrive first few bytes of table through Matrix calculations, then find which special b-exact key is used.

tl;dr

• This is a fairly simple Maze challenge
• Challenge is written in rust

tl;dr

• Race condition to change the type.
• Leak using uninitialized memory and get rip with overflow.