Exf at 13:59, 13 October 2022

2022-10-13T13:59:35Z

← Older revision		Revision as of 13:59, 13 October 2022
Line 1:		Line 1:
			[[File:Encoded-task.PNG\|thumb\|Encoder task]]
			[[File:Encoded-flag.PNG\|thumb\|Encoder flag + command]]

	===Description===		===Description===
	This web application allows you to use coding utility to encode and decode base64		This web application allows you to use coding utility to encode and decode base64

Exf: Created page with "===Description=== This web application allows you to use coding utility to encode and decode base64 100pts ===Question=== Investigate the application, exploit the vulnerability and read the flag from /var/backup/secret.txt ===Solution=== First, I ran a vulnerability scan on the website with the ZAP tool. Unfortunately, nothing was found. Next I tried to enter all kind of commands to both decoder and encoder sides. I realized that especiality I got errors from decoding..."

2022-10-13T13:58:36Z

Created page with "===Description=== This web application allows you to use coding utility to encode and decode base64 100pts ===Question=== Investigate the application, exploit the vulnerability and read the flag from /var/backup/secret.txt ===Solution=== First, I ran a vulnerability scan on the website with the ZAP tool. Unfortunately, nothing was found. Next I tried to enter all kind of commands to both decoder and encoder sides. I realized that especiality I got errors from decoding..."

New page

===Description===
This web application allows you to use coding utility to encode and decode base64

100pts
===Question===
Investigate the application, exploit the vulnerability and read the flag from /var/backup/secret.txt
===Solution===
First, I ran a vulnerability scan on the website with the ZAP tool. Unfortunately, nothing was found.

Next I tried to enter all kind of commands to both decoder and encoder sides. I realized that especiality I got errors from decoding side when I was entering commands like <code>include, ls, &&</code>.

I entered similar commands on the encoding side and tried the following command <code>&& cat /var/backup/secret.txt</code>
This web page returned a long base64 string that looked nothing like the previous ones. I decoded that string twice and got the task flag for myself.
===Tools===
* base64
===Flag===
<code>efa58858-a4d0-43ce-ab8d-44ed5b5aaa1b</code>
===Links===
*[[CTF Challenges | Back to CTF Challenges page]]

Encoder - Revision history

Exf at 13:59, 13 October 2022