← BACK TO OPS CENTER

Write-up Archive

CTF write-ups with tiered hints: try it yourself, and reveal the hint only if you need it. The full solution and flag stay hidden until you choose to see them.

01. OP: GHOST_TRAFFIC

Vuln: DNS Tunneling
Traffic looks normal… but what if DNS carries more than domain names? Open the .pcap and filter by "dns".
  1. Open the .pcap file in Wireshark.
  2. Apply the "dns" filter to isolate that traffic.
  3. Look for DNS responses with unusually long text; the flag is there.
[ REVEAL FLAG ]

02. OP: SECURE_DEV

Vuln: Logic Bomb / Insecure eval()
The danger is a function that runs text as if it were code. Find it in the Python.
  1. Read the provided Python code.
  2. Locate the eval() function, which runs code insecurely.
  3. Read the comment next to the vulnerability to find the flag.
[ REVEAL FLAG ]

03. OP: DEEP_STATE

Vuln: Steganography
An image can hide more than it shows. What is at the end of the binary file? Think "strings".
  1. Download the image.
  2. In the terminal, run: strings image.png | grep FLAG
  3. The hidden text at the end of the binary will be displayed.
[ REVEAL FLAG ]

04. OP: FOOTPRINT

Vuln: Command History Leak
The attacker thought they wiped their tracks, but the command history remembers everything.
  1. Open the attacker_history.txt file.
  2. Read the commands the attacker used before trying to wipe them.
  3. One of the "echo" commands reveals the flag.
[ REVEAL FLAG ]

05. OP: ROBOTS

Vuln: Information Disclosure
Search engines obey a special file at the site root. What is that file trying to hide?
  1. Go to the browser address bar.
  2. Append "/robots.txt" to the domain.
  3. Read the plain text to find the secret.
[ REVEAL FLAG ]

06. OP: SOURCE

Vuln: Source Code Comments
What you see is not all there is. Look at the source (Ctrl+U)… all the way down.
  1. Open the CyberEscudo homepage.
  2. Press Ctrl+U to view the source.
  3. Scroll to the bottom to find a hidden HTML comment.
[ REVEAL FLAG ]

07. OP: HEADERS

Vuln: HTTP Response Headers
The server response is chatty. Check the headers in the Network tab.
  1. Open DevTools (F12) and go to the "Network" tab.
  2. Reload and click the main document.
  3. Look for the custom "X-Cyber-Access" header.
[ REVEAL FLAG ]

08. OP: B64-DECODE

Vuln: Base64 Encoding
That text is not encrypted, just "disguised" in a very common format (often ends in "=").
  1. Copy the encoded string from the briefing.
  2. Use the platform Base64 tool to decode it.
[ REVEAL FLAG ]

09. OP: COOKIE_MONSTER

Vuln: Unsecured Session Cookies

10. OP: DOUBLE-CIPHER

Vuln: Chained Encoding (Base64 + ROT13)
One layer is not enough. Decode the obvious first… then notice the letters look "rotated".
  1. Decode the initial string with Base64.
  2. The result is readable but encrypted text (Caesar/ROT).
  3. Apply ROT13 to the result to get the flag.
[ REVEAL FLAG ]

11. OP: JWT-TOKEN

Vuln: JWT Payload Exposure
A JWT has 3 dot-separated parts. The signature protects it, but the middle one is only encoded, not encrypted.
  1. Copy the middle part of the token (between the two dots).
  2. Base64-decode it to read the JSON.
[ REVEAL FLAG ]

12. OP: BROKEN-HASH

Vuln: MD5 Hash Cracking
MD5 is fast… which is why it is broken. That hash probably already lives in a public database.
  1. Copy the MD5 hash.
  2. Run it through a cracker (native tool or CrackStation) with Rainbow Tables.
[ REVEAL FLAG ]

13. OP: DIGITAL-TRAIL

Vuln: OSINT / SSL Logs
Every issued SSL cert leaves a public trail (Certificate Transparency, crt.sh). Check the subdomain list.
  1. Download the simulated crt.sh JSON.
  2. Inspect the subdomain list.
  3. One of the leaked subdomains is the flag.
[ REVEAL FLAG ]

14. OP: IDOR-ACCESS

Vuln: Insecure Direct Object Reference (IDOR)
If 42 is your profile… what if you try other IDs? The admin one is not always protected.
  1. Observe the URL: user-api.php?user_id=42.
  2. Change 42 to 7 (administrator profile).
  3. The API returns the flag in JSON.
[ REVEAL FLAG ]

15. OP: EXIF-DATA

Vuln: Metadata Leak
Photos store hidden metadata (EXIF). The photographer may have left something written there.
  1. Download the image.
  2. Use exiftool or Properties > Details on Windows.
  3. The flag is in the Comment or Description field.
[ REVEAL FLAG ]

16. OP: XOR-CRYPTO

Vuln: Weak XOR Obfuscation
XOR reverses with the same key. What if the key were something as simple as a small number related to "flag"?
  1. Take the array of hexadecimal bytes.
  2. The key is the length of "flag": the number 4.
  3. Python chr(byte ^ 4) or CyberChef (XOR with key 4) to reverse it.
[ REVEAL FLAG ]

17. OP: SHADOW_PATH

Vuln: Path Traversal / WAF Bypass
The WAF blocks raw "../" (403)… but does it recognize that same character when URL-encoded?
  1. The server loads files with "?file=". A raw "../" is blocked by the WAF (403).
  2. To bypass it, use URL Encoding: "../" equals "%2E%2E%2F".
  3. The vault is 3 levels up: ?file=%2E%2E%2F%2E%2E%2F%2E%2E%2Fhidden_vault/credentials.txt
[ REVEAL FLAG ]