It's fall again, and like every year, many CTF are happening in those few months.

Earlier this week I participated in the hack.lu CTF. A CTF organized by the FluxFingers team as a part of the hack.lu conference in luxembourg. It was a pretty cool CTF with interesting challenges to solve. I'm not going to do any writeup since there was really nothing interesting to say about the challenges I worked on. You can always find writeups on the web if you're interested. There are a few on shell-storm.org.

I also participated in the ...

0 Commentaires / Lire la suite...

Hello,
This writeup will cover a 300points web mission we solved during PlaidCTF 2011. We had access to a simple guestbook with a form. We tried to trigger a bug unsuccessfully. At first, we thought the vulnerability might be a flaw in csrf handling because of the advisory published last february. The app was reacting strangely to the csrf cookie, (re)setting it multiple times, but then the organizers removed the csrf check altogether.

We were stuck at this point until a hint was given: django settings file contained a reference to a memcached server. We hadn't tried to ...

0 Commentaires / Lire la suite...