DEV Community

Hacker101 CTF - Micro-CMS v1

DaNeil C on October 18, 2019

MORE CTFSSSSSS Recently I've started diving into CTFs and trying my hand at some Bug Bounties. This means that I will need to be writing reports wi...
Read full post
Collapse
 
paul2t profile image
Paul DE TEMMERMAN •

Your solution for Flag2 is not correct.
Hint: The title of a page is not escaped in the home page.
Solution: Set the title of a page to: <
And then go to the Home page. An alert will show up with this flag.

Collapse
 
caffiendkitten profile image
DaNeil C •

Hi Paul, It's good to know that there is another approach to this flag. Thanks for showing me another way.

Collapse
 
v2kumar profile image
Vivek Kumar •

Can you tell me how did you find this solution E.g How'd you reach to that solution

Collapse
 
paul2t profile image
Paul DE TEMMERMAN •

I found it by mistake. I was trying random things and suddenly when I went on the home page, the flag popped up.
I then tried to figure out what caused this flag to appear and found that it was the title of the page. I tried different inputs to see what could make it appear, I found that '<' was the minimal thing I could do.

Thread Thread
 
v2kumar profile image
Vivek Kumar •

Thanks

Collapse
 
prajwalmithun profile image
vanquisher •

Flag 1 another approach.

You need to do XSS.

       1. You need to go to Create new page.  
       2. Add this <script>alert(100)</script> in both the title and 
          description section, since these are the input entry points,xss should be done in those points. And the number 100 may be any number. 
       3. Click <--go-Home.
Enter fullscreen mode Exit fullscreen mode

Walla!! you get the flag in the pop up

Collapse
 
onyxcode profile image
Dan •

Thank you so much! I was stuck on the explanation given for Flag1 :)

Collapse
 
suther profile image
Samuel Suther •

Flag 3 has another approach.
You don't need to add that "flag"-Parameter.
You only have to use another way to inject JavaScript in the code but with a script-tag.

For example, I have add an Image and new Image-Tage in an edited page, and add an alert in onclick. Thats solved this 3rd Flag. For you the solution was only the onclick in your button. ;)

Collapse
 
drledesma profile image
Juan Ledesma • • Edited

Im recently new to do this and its my first Hacker101 test. You helped me with Flag 1. So I found the answer to Why the Single Quote worked for this flag. Its because of SQL injection here link for more details. Thank you!
netsparker.com/blog/web-security/f...

Collapse
 
caffiendkitten profile image
DaNeil C •

Glad I could help with the first flag!
A " Fragmented SQL Injection" is not a phrase I've heard so much. Much grateful for the link to more info.