Write-ups
Personal WebsiteGithubLinkedIn
  • Home
  • Blue Team Labs Online
    • ATT&CK
    • D3FEND
    • Log Analysis - Privilege Escalation
    • Meta
    • Network Analysis – Web Shell
    • Shiba Insider
    • The Planet's Prestige
    • The Report
  • bWAPP
    • HTML Injection - Reflected (GET)
    • HTML Injection - Reflected (POST)
    • HTML Injection - Reflected (URL)
    • HTML Injection - Stored (Blog)
    • iFrame Injection
  • Command Challenge
    • Command Challenge
    • Oops I deleted my bin/ dir :(
    • Twelve Days of Shell
  • CryptoHack
    • General
      • Encoding
        • ASCII
        • Hex
        • Base64
        • Bytes and Big Integers
      • XOR
        • XOR Starter
        • XOR Properties
        • Favourite byte
      • Mathematics
        • Greatest Common Divisor
        • Extended GCD
  • CSAW 2023
    • Baby's First
    • Baby's Third
    • my_first_pwnie
    • target_practice
  • CTFLearn
    • Binary
      • Simple bof
    • Cryptography
      • 5x5 Crypto
      • Base 2 2 the 6
      • Character Encoding
      • Substitution Cipher
      • Tux!
    • Forensics
      • Forensics 101
      • Git Is Good
      • PDF by fdpumyp
      • Pho Is Tasty!
      • PikesPeak
      • Simple Steganography
      • Taking LS
      • WOW.... So Meta
  • CyberDefenders
    • BlackEnergy
    • Emprisa Maldoc
    • HawkEye
    • HoneyBOT
    • Insider
    • Obfuscated
    • PacketMaze
    • RE101
    • Redline
    • XLM Macros
  • DVWA
    • Brute Force
    • Command Injection
    • CSRF
    • SQL Injection
    • SQL Injection (Blind)
    • Weak Session IDs
    • XSS (DOM)
    • XSS (Reflected)
    • XSS (Stored)
  • Ethernaut
    • 00 - Hello Ethernaut
  • Exploit Education
    • Protostar
      • Stack Zero
      • Stack One
      • Stack Two
      • Stack Three
      • Stack Four
      • Format Zero
  • Google CTF - Beginner's Quest
    • 0000
    • 1837
    • 1943
    • 1965
    • 1987
    • 1988
    • 1989
    • 1990
    • 1994
  • Hacker101
    • Postbook
  • LetsDefend
    • DFIR
      • Phishing
        • Email Analysis
        • Phishing Email
  • Microcorruption
    • New Orleans
    • Sydney
    • Hanoi
    • Reykjavik
    • Cusco
  • NetGarage IO
    • level 1
    • level 2
  • OverTheWire
    • Bandit
  • PicoCTF
    • Forensics
      • information
    • Binary Exploitation
      • Stonks
    • Web Exploitation
      • Cookies
      • dont-use-client-side
      • GET aHEAD
      • Includes
      • Insp3ct0r
      • Insect HTML
      • login
      • where are the robots
  • PortSwigger labs
    • Client-side topics
      • Cross-site scripting (XSS)
        • Reflected XSS into HTML context with nothing encoded
        • Stored XSS into HTML context with nothing encoded
        • DOM XSS in document.write sink using source location.search
        • DOM XSS in innerHTML sink using source location.search
        • DOM XSS in jQuery anchor href attribute sink using location.search source
        • DOM XSS in jQuery selector sink using a hashchange event
        • Reflected XSS into attribute with angle brackets HTML-encoded
        • Stored XSS into anchor href attribute with double quotes HTML-encoded
    • Server-side topics
      • SQL injection
        • SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
        • SQL injection vulnerability allowing login bypass
        • SQL injection attack, querying the database type and version on Oracle
        • SQL injection attack, querying the database type and version on MySQL and Microsoft
        • SQL injection attack, listing the database contents on non-Oracle databases
        • SQL injection attack, listing the database contents on Oracle
        • SQL injection UNION attack, determining the number of columns returned by the query
        • SQL injection UNION attack, finding a column containing text
        • SQL injection UNION attack, retrieving data from other tables
        • SQL injection UNION attack, retrieving multiple values in a single column
      • Authentication
        • Username enumeration via subtly different responses
        • Password reset broken logic
        • Username enumeration via different responses
        • 2FA simple bypass
      • Path traversal
        • File path traversal, traversal sequences stripped non-recursively
        • File path traversal, traversal sequences blocked with absolute path bypass
        • File path traversal, simple case
        • File path traversal, traversal sequences stripped with superfluous URL-decode
        • File path traversal, validation of start of path
        • File path traversal, validation of file extension with null byte bypass
      • Command injection
        • Blind OS command injection with output redirection
        • OS command injection, simple case
        • Blind OS command injection with time delays
      • Business logic vulnerabilities
        • Flawed enforcement of business rules
        • Excessive trust in client-side controls
        • Inconsistent security controls
        • High-level logic vulnerability
      • Information disclosure
        • Authentication bypass via information disclosure
        • Source code disclosure via backup files
        • Information disclosure on debug page
        • Information disclosure in error messages
      • Access control
        • Referer-based access control
        • Multi-step process with no access control on one step
        • Insecure direct object references
        • URL-based access control can be circumvented
        • Method-based access control can be circumvented
        • User ID controlled by request parameter with password disclosure
        • User ID controlled by request parameter with data leakage in redirect
        • User ID controlled by request parameter, with unpredictable user IDs
        • User ID controlled by request parameter
        • User role can be modified in user profile
        • Unprotected admin functionality with unpredictable URL
        • Unprotected admin functionality
        • User role controlled by request parameter
      • Server-side request forgery (SSRF)
        • Basic SSRF against another back-end system
        • Basic SSRF against the local server
        • SSRF with blacklist-based input filter
      • XXE injection
        • Exploiting XXE to perform SSRF attacks
        • Exploiting XXE using external entities to retrieve files
  • Pwn College
    • Assembly Crash Course
    • Building a Web Server
    • Cryptography
    • Debugging Refresher
    • Intercepting Communication
    • Memory Errors
    • Program Interaction
    • Program Misuse
    • Reverse Engineering
    • Sandboxing
    • Shellcode Injection
    • Talking Web
    • Web Security
  • pwanable.kr
    • fd
    • random
  • Root Me
    • App - System
      • ELF x86 - Stack buffer overflow basic 1
    • Web - Client
      • HTML-disabled buttons
      • Javascript - Authentication
      • Javascript - Source
      • Javascript - Authentication 2
      • Javascript - Obfuscation 1
      • Javascript - Obfuscation 2
      • Javascript - Native code
    • Web - Server
      • HTML - Source code
      • HTTP - IP restriction bypass
      • HTTP - Open redirect
      • HTTP - User-agent
      • PHP - Command injection
      • HTTP - Directory indexing
      • HTTP - Headers
      • HTTP - POST
      • HTTP - Improper redirection
      • HTTP - Verb tampering
      • Install files
  • ROP Emporium
    • ret2win
    • split
  • TryHackMe
    • Easy
      • Agent Sudo
      • Anthem
      • Archangel
      • Bounty Hacker
      • Brooklyn Nine Nine
      • Brute It
      • c4ptur3-th3-fl4g
      • Chill Hack
      • Crack the Hash
      • CTF collection Vol.1
      • Cyborg
      • Fowsniff CTF
      • GamingServer
      • h4cked
      • LazyAdmin
      • Lian_Yu
      • OhSINT
      • Overpass
      • Pickle Rick
      • RootMe
      • Searchlight - IMINT
      • Simple CTF
      • Startup
      • Sudo Security Bypass
      • tomghost
      • Wgel CTF
      • Year of the Rabbit
    • Medium
      • Anonymous
      • ConvertMyVideo
      • UltraTech
  • Under The Wire
    • Century
    • Cyborg
  • W3Challs
    • Web
      • Change your browser
  • Websec.fr
    • level01
    • level04
    • level17
    • level25
    • level28
Powered by GitBook
On this page

Was this helpful?

  1. CTFLearn
  2. Forensics

Git Is Good

The flag used to be there. But then I redacted it. Good Luck. https://mega.nz/#!3CwDFZpJ!Jjr55hfJQJ5-jspnyrnVtqBkMHGJrd6Nn_QqM7iXEuc

Let's look at the contents of the directory.

>dir
 Volume in drive D is DATA
 Volume Serial Number is 904D-581D

 Directory of D:\gitIsGood

30-10-2016  14:33    <DIR>          .
30-10-2016  14:33    <DIR>          ..
30-10-2016  14:33    <DIR>          .git
30-10-2016  14:33                15 flag.txt
               1 File(s)             15 bytes
               3 Dir(s)  662,738,264,064 bytes free

We can look at the .git directory for the information about the project.

>dir
 Volume in drive D is DATA
 Volume Serial Number is 904D-581D

 Directory of D:\gitIsGood\.git

30-10-2016  14:33    <DIR>          .
30-10-2016  14:33    <DIR>          ..
30-10-2016  14:31    <DIR>          branches
30-10-2016  14:33               220 COMMIT_EDITMSG
30-10-2016  14:31               137 config
30-10-2016  14:31                73 description
30-10-2016  14:31                23 HEAD
30-10-2016  14:31    <DIR>          hooks
30-10-2016  14:33               137 index
30-10-2016  14:31    <DIR>          info
30-10-2016  14:32    <DIR>          logs
30-10-2016  14:33    <DIR>          objects
30-10-2016  14:31    <DIR>          refs
               5 File(s)            590 bytes
               8 Dir(s)  662,738,264,064 bytes free

We can look at the logs using the git log command.

>git log
commit d10f77c4e766705ab36c7f31dc47b0c5056666bb (HEAD -> master)
Author: LaScalaLuke <lascala.luke@gmail.com>
Date:   Sun Oct 30 14:33:18 2016 -0400

    Edited files

commit 195dd65b9f5130d5f8a435c5995159d4d760741b
Author: LaScalaLuke <lascala.luke@gmail.com>
Date:   Sun Oct 30 14:32:44 2016 -0400

    Edited files

commit 6e824db5ef3b0fa2eb2350f63a9f0fdd9cc7b0bf
Author: LaScalaLuke <lascala.luke@gmail.com>
Date:   Sun Oct 30 14:32:11 2016 -0400

    edited files

So the flag.txt file was edited three times in the span of around two minutes.

If we use the -p flag, we can see what the edits were.

>git log -p
commit d10f77c4e766705ab36c7f31dc47b0c5056666bb (HEAD -> master)
Author: LaScalaLuke <lascala.luke@gmail.com>
Date:   Sun Oct 30 14:33:18 2016 -0400

    Edited files

diff --git a/flag.txt b/flag.txt
index 8684e68..c5250d0 100644
--- a/flag.txt
+++ b/flag.txt
@@ -1 +1 @@
-flag{protect_your_git}
+flag{REDACTED}

commit 195dd65b9f5130d5f8a435c5995159d4d760741b
Author: LaScalaLuke <lascala.luke@gmail.com>
Date:   Sun Oct 30 14:32:44 2016 -0400

    Edited files

diff --git a/flag.txt b/flag.txt
index c5250d0..8684e68 100644
--- a/flag.txt
+++ b/flag.txt
@@ -1 +1 @@
-flag{REDACTED}
+flag{protect_your_git}

commit 6e824db5ef3b0fa2eb2350f63a9f0fdd9cc7b0bf
Author: LaScalaLuke <lascala.luke@gmail.com>
Date:   Sun Oct 30 14:32:11 2016 -0400

    edited files

diff --git a/flag.txt b/flag.txt
new file mode 100644
index 0000000..c5250d0
--- /dev/null
+++ b/flag.txt
@@ -0,0 +1 @@
+flag{REDACTED}

Now we know that the flag was flag{REDACTED}, which was then changed to flag{protect_your_git} and then again changed to flag{REDACTED}.

Flag

flag{protect_your_git}

Last updated 1 year ago

Was this helpful?