Hilltop CTF – Writeups

Thu, 04 Jun 2020 21:42:45 +0000

Hi everyone,

A blog post on a different topic this time. I was a Content Engineer for the Hilltop CTF event.

Write-up for the Fuzz challenge.

Challenge name: Fuzz

Creator: MasterWayZ

Category: Analysis/Fuzzing

Summary:

The user is given a URL to look at: http://shellserver1.hilltopctf.masterwayz.nl:5876/

How-To:

Using a program like gobuster, we can try to see what directories exist: gobuster dir -u http://shellserver1.hilltopctf.masterwayz.nl:5876/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt.
We get a /301 redirect of /penguins. From here, it’s a matter of running gobuster dir -u http://shellserver1.hilltopctf.masterwayz.nl:5876/penguins/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt. The txt extension comes from the .txt file part in the README.md file.

Explanation:

We use gobuster to try to see what folder it is hidden in. dir specifies directory mode, -u specifies the URL and -w specifies the wordlist.
a 301 redirect of /penguins means that we’ve found something. Now we need to find the file in that directory. The new flag, -x specifies the extension used by gobuster to try to find files.

Write-up for the Fuzzy challenge.

Challenge name: Fuzzy

Creator: MasterWayZ

Category: Analysis/Fuzzing, Attacks/Cracking

Summary:

For this challenge, you need to fuzz a Flask webserver to start with. Followed by brute-forcing a password and then automating or guessing the missing character in the flag.

Hilltop CTF on MichelleWayZ | Michelle Goossens | Blog

Hilltop CTF – Writeups

Write-up for the Fuzz challenge.

Challenge name: Fuzz

Creator: MasterWayZ

Category: Analysis/Fuzzing

Summary:

How-To:

Explanation:

Write-up for the Fuzzy challenge.

Challenge name: Fuzzy

Creator: MasterWayZ

Category: Analysis/Fuzzing, Attacks/Cracking

Summary: