MongoDB authentication bypass using NoSQL injection ($ne operator) and blind injection with $regex to extract the admin password character by character.

nosql-injectionmongodbweb +3

$ Apr 26, 2019

AngstromCTF

Medium 120pts

AngstromCTF 2019 — Secret Sheep Society (AES CBC Bit-Flipping)

[Crypto]

AES-CBC bit-flipping attack to forge a session cookie and escalate privileges from regular user to admin.

cryptoaes-cbcbit-flipping +3

$ Apr 24, 2019

HacklabESGI

Medium 100pts

Hacklab ESGI 2019 — Rookie Web100 (SSRF via Gopher)

[Web]

SSRF vulnerability in a curl-based web app exploited using the gopher:// protocol to connect to an internal MySQL database and extract the flag.

Securinets CTF 2019 — Lost Flag (Exploiting Bazaar VCS)

[Web/Forensics]

Discover a hidden Bazaar VCS repository on a web server, clone it, and revert to a previous revision to recover a deleted flag file.

vcsbazaarweb +3

$ Mar 26, 2019