Write-ups
Personal WebsiteGithubLinkedIn
  • Home
  • Blue Team Labs Online
    • ATT&CK
    • D3FEND
    • Log Analysis - Privilege Escalation
    • Meta
    • Network Analysis – Web Shell
    • Shiba Insider
    • The Planet's Prestige
    • The Report
  • bWAPP
    • HTML Injection - Reflected (GET)
    • HTML Injection - Reflected (POST)
    • HTML Injection - Reflected (URL)
    • HTML Injection - Stored (Blog)
    • iFrame Injection
  • Command Challenge
    • Command Challenge
    • Oops I deleted my bin/ dir :(
    • Twelve Days of Shell
  • CryptoHack
    • General
      • Encoding
        • ASCII
        • Hex
        • Base64
        • Bytes and Big Integers
      • XOR
        • XOR Starter
        • XOR Properties
        • Favourite byte
      • Mathematics
        • Greatest Common Divisor
        • Extended GCD
  • CSAW 2023
    • Baby's First
    • Baby's Third
    • my_first_pwnie
    • target_practice
  • CTFLearn
    • Binary
      • Simple bof
    • Cryptography
      • 5x5 Crypto
      • Base 2 2 the 6
      • Character Encoding
      • Substitution Cipher
      • Tux!
    • Forensics
      • Forensics 101
      • Git Is Good
      • PDF by fdpumyp
      • Pho Is Tasty!
      • PikesPeak
      • Simple Steganography
      • Taking LS
      • WOW.... So Meta
  • CyberDefenders
    • BlackEnergy
    • Emprisa Maldoc
    • HawkEye
    • HoneyBOT
    • Insider
    • Obfuscated
    • PacketMaze
    • RE101
    • Redline
    • XLM Macros
  • DVWA
    • Brute Force
    • Command Injection
    • CSRF
    • SQL Injection
    • SQL Injection (Blind)
    • Weak Session IDs
    • XSS (DOM)
    • XSS (Reflected)
    • XSS (Stored)
  • Ethernaut
    • 00 - Hello Ethernaut
  • Exploit Education
    • Protostar
      • Stack Zero
      • Stack One
      • Stack Two
      • Stack Three
      • Stack Four
      • Format Zero
  • Google CTF - Beginner's Quest
    • 0000
    • 1837
    • 1943
    • 1965
    • 1987
    • 1988
    • 1989
    • 1990
    • 1994
  • Hacker101
    • Postbook
  • LetsDefend
    • DFIR
      • Phishing
        • Email Analysis
        • Phishing Email
  • Microcorruption
    • New Orleans
    • Sydney
    • Hanoi
    • Reykjavik
    • Cusco
  • NetGarage IO
    • level 1
    • level 2
  • OverTheWire
    • Bandit
  • PicoCTF
    • Forensics
      • information
    • Binary Exploitation
      • Stonks
    • Web Exploitation
      • Cookies
      • dont-use-client-side
      • GET aHEAD
      • Includes
      • Insp3ct0r
      • Insect HTML
      • login
      • where are the robots
  • PortSwigger labs
    • Client-side topics
      • Cross-site scripting (XSS)
        • Reflected XSS into HTML context with nothing encoded
        • Stored XSS into HTML context with nothing encoded
        • DOM XSS in document.write sink using source location.search
        • DOM XSS in innerHTML sink using source location.search
        • DOM XSS in jQuery anchor href attribute sink using location.search source
        • DOM XSS in jQuery selector sink using a hashchange event
        • Reflected XSS into attribute with angle brackets HTML-encoded
        • Stored XSS into anchor href attribute with double quotes HTML-encoded
    • Server-side topics
      • SQL injection
        • SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
        • SQL injection vulnerability allowing login bypass
        • SQL injection attack, querying the database type and version on Oracle
        • SQL injection attack, querying the database type and version on MySQL and Microsoft
        • SQL injection attack, listing the database contents on non-Oracle databases
        • SQL injection attack, listing the database contents on Oracle
        • SQL injection UNION attack, determining the number of columns returned by the query
        • SQL injection UNION attack, finding a column containing text
        • SQL injection UNION attack, retrieving data from other tables
        • SQL injection UNION attack, retrieving multiple values in a single column
      • Authentication
        • Username enumeration via subtly different responses
        • Password reset broken logic
        • Username enumeration via different responses
        • 2FA simple bypass
      • Path traversal
        • File path traversal, traversal sequences stripped non-recursively
        • File path traversal, traversal sequences blocked with absolute path bypass
        • File path traversal, simple case
        • File path traversal, traversal sequences stripped with superfluous URL-decode
        • File path traversal, validation of start of path
        • File path traversal, validation of file extension with null byte bypass
      • Command injection
        • Blind OS command injection with output redirection
        • OS command injection, simple case
        • Blind OS command injection with time delays
      • Business logic vulnerabilities
        • Flawed enforcement of business rules
        • Excessive trust in client-side controls
        • Inconsistent security controls
        • High-level logic vulnerability
      • Information disclosure
        • Authentication bypass via information disclosure
        • Source code disclosure via backup files
        • Information disclosure on debug page
        • Information disclosure in error messages
      • Access control
        • Referer-based access control
        • Multi-step process with no access control on one step
        • Insecure direct object references
        • URL-based access control can be circumvented
        • Method-based access control can be circumvented
        • User ID controlled by request parameter with password disclosure
        • User ID controlled by request parameter with data leakage in redirect
        • User ID controlled by request parameter, with unpredictable user IDs
        • User ID controlled by request parameter
        • User role can be modified in user profile
        • Unprotected admin functionality with unpredictable URL
        • Unprotected admin functionality
        • User role controlled by request parameter
      • Server-side request forgery (SSRF)
        • Basic SSRF against another back-end system
        • Basic SSRF against the local server
        • SSRF with blacklist-based input filter
      • XXE injection
        • Exploiting XXE to perform SSRF attacks
        • Exploiting XXE using external entities to retrieve files
  • Pwn College
    • Assembly Crash Course
    • Building a Web Server
    • Cryptography
    • Debugging Refresher
    • Intercepting Communication
    • Memory Errors
    • Program Interaction
    • Program Misuse
    • Reverse Engineering
    • Sandboxing
    • Shellcode Injection
    • Talking Web
    • Web Security
  • pwanable.kr
    • fd
    • random
  • Root Me
    • App - System
      • ELF x86 - Stack buffer overflow basic 1
    • Web - Client
      • HTML-disabled buttons
      • Javascript - Authentication
      • Javascript - Source
      • Javascript - Authentication 2
      • Javascript - Obfuscation 1
      • Javascript - Obfuscation 2
      • Javascript - Native code
    • Web - Server
      • HTML - Source code
      • HTTP - IP restriction bypass
      • HTTP - Open redirect
      • HTTP - User-agent
      • PHP - Command injection
      • HTTP - Directory indexing
      • HTTP - Headers
      • HTTP - POST
      • HTTP - Improper redirection
      • HTTP - Verb tampering
      • Install files
  • ROP Emporium
    • ret2win
    • split
  • TryHackMe
    • Easy
      • Agent Sudo
      • Anthem
      • Archangel
      • Bounty Hacker
      • Brooklyn Nine Nine
      • Brute It
      • c4ptur3-th3-fl4g
      • Chill Hack
      • Crack the Hash
      • CTF collection Vol.1
      • Cyborg
      • Fowsniff CTF
      • GamingServer
      • h4cked
      • LazyAdmin
      • Lian_Yu
      • OhSINT
      • Overpass
      • Pickle Rick
      • RootMe
      • Searchlight - IMINT
      • Simple CTF
      • Startup
      • Sudo Security Bypass
      • tomghost
      • Wgel CTF
      • Year of the Rabbit
    • Medium
      • Anonymous
      • ConvertMyVideo
      • UltraTech
  • Under The Wire
    • Century
    • Cyborg
  • W3Challs
    • Web
      • Change your browser
  • Websec.fr
    • level01
    • level04
    • level17
    • level25
    • level28
Powered by GitBook
On this page
  • level 1.0
  • level 1.1
  • level 2.0
  • level 3.0
  • level 4.0
  • level 5.0

Was this helpful?

  1. Pwn College

Reverse Engineering

level 1.0

Reverse engineer this challenge to find the correct license key.

Let's provide an input which we can easily spot such as abcde.

Initial input:

        61 62 63 64 65 

The mangling is done! The resulting bytes will be used for the final comparison.

Final result of mangling input:

        61 62 63 64 65 

We can see that the program didn't actually mangle our input.

The program also tells us what the expected result is.

Expected result:

        6b 78 71 68 73 <------ kxqhs

Since there is no mangling performed we can just input kxqhs which is the ASCII representation of the expected input.

level 1.1

In this level the program does not print out the expected input.

Lets open babyrev_level1.1 in Ghidra.

On examining the .data section, we can see that the expected input is "hgsaa".

level 2.0

This challenge is now mangling your input using the swap mangler for indexes 3 and 4.

We will provide the same initial input as before.

Initial input:

        61 62 63 64 65 

This challenge is now mangling your input using the `swap` mangler for indexes `3` and `4`.

This mangled your input, resulting in:

        61 62 63 65 64 

The mangling is done! The resulting bytes will be used for the final comparison.

We can see that the fourth and fifth characters have been flipped. Let's keep this in mind for when we provide the actual key.

Looking at the expected result tells us what the actual key would look like after mangling is done.

Expected result:

        6a 6b 76 74 66 <------ jkvtf

Remember that the fourth and fifth bytes are flipped, so jkvft is actual the key.

level 3.0

This challenge is now mangling your input using the reverse mangler.

This level also mangles our input using a reverse mangler.

Initial input:

        61 62 63 64 65 

This challenge is now mangling your input using the `reverse` mangler.

This mangled your input, resulting in:

        65 64 63 62 61 

The mangling is done! The resulting bytes will be used for the final comparison.

As we can see, the order of our input bytes have been flipped, i.e. the LSB is now MSB and vice-versa.

Let's look at the expected result after mangling.

Expected result:

        65 78 63 73 64 <------ excsd

The expected result after reversing is excsd, therefore the key dscxe is what we have to provide as user input.

level 4.0

This challenge is now mangling your input using the sort mangler.

This one is similar to level 1.0.

Initial input:

        61 62 63 64 65 

This challenge is now mangling your input using the `sort` mangler.

This mangled your input, resulting in:

        61 62 63 64 65 

The mangling is done! The resulting bytes will be used for the final comparison.

As we can see our input hasn't actually been sorted.

We simply have to provide the expected result as the key.

Expected result:

        66 67 67 6b 79 <---- fggky

Our key will be fggky.

level 5.0

Initial input: 31 32 33 34 35
Mangled input: 34 37 36 31 30

Expected input: 67 69 60 61 60 <---- gi`a`

Each character is mapped to some other character .

If we provide the expected characters, we can see what characters they are mapped to.

Initial input: 67 69 60 61 60 <---- gi`a`
Mangled input: 62 6c 65 64 65 <---- blede

Expected input: 67 69 60 61 60 <---- gi`a`

So we must provide the string to which expected input is mapped (i.e. blede).

Last updated 1 year ago

Was this helpful?