DEFCON CTF 2013 Quals “grandprix” Writeup

This time at DEFCON CTF quals there was a special task category, namely OMGACM or competitive programming. Here is a solution to OMGACM 3 task. We have a remote host that offers to play a race game: Connected to grandprix.shallweplayaga.me. Escape character is ‘^]’. Use ‘l’ and ‘r’ to move. Don’t crash. Press return to […]

PHDays 2013 CTF “Blade” Writeup

We have a simple form with login and password. There is an SQL injection, but a WAF blocks any attempt to bypass it. First step to solve this task was to reveal the contents of the script by requesting index.phps: <?php include ‘flag.php’; if (!isset($_POST[‘username’]) || !isset($_POST[‘password’])) { print <<<FORM <form method=POST> <input type=text name=username></input> […]