Crack Me 3 - CTF Challenge
The challenge involved reverse-engineering a compiled 64-bit ELF PIE executable to extract an encoded flag hidden in memory.
Samy Security Blog
Latest posts
3 scary tools that use Shodan search engine
Shodan is a search engine very different from the classic search engines that we are used to. Indeed, when Google or Yahoo! crawl only for ports 80 (http) and 443 (https) open and accessible on the world wide web, Shodan, crawl all the open ports from 1 to 65535. This means that Shodan, unlike any normal search engine, does not focus on searching for web pages but on collecting banners of services…
Are professional hackers also excellent magicians?
Generally speaking, the pattern is always the same. You will find a vulnerability, you will exploit it, then comes the part of privileges escalation. And that's it, you are root, master of the machine and as you don't have time you will install a backdoor, somewhere, well hidden, to do what you want with this new machine later. And then... You logout! The first mistake has just been made.
3 ways to become root by exploiting the .bashrc file
You did it! You have discovered a vulnerability and successfully exploited it. Congratulations, you have gained access to the server. However, as your current user rights do not permit you to make significant changes to the machine, this is where the real investigation begins.
VPN Ivacy, insecure design vulnerability discovered.
Few weeks ago, having finally got a real internet connection at home (no more pocket WiFi!), I started looking for a VPN provider to fully enjoy Netflix. In the same time, lucky as I am (or not), one of the blogs that's I often visit for my technology watch was advertising a VPN that I never heard before called Ivacy. The first thing that caught my attention was the price, Ivacy offers more than…
Build your own WiFi Pineapple Tetra for $7.
Let's talk about the WiFi Pineapple! This little gem normally sells for about $99 that allows cybercriminals pentesters to capture data shared on public WiFi networks. I've been hesitating to buy one for a few weeks now. After buying a Rubber Ducky on hak5's website, my attention was quickly caught up by all the little technology jewels that they also offered on their website. I couldn't get my…
JabberJaw - Convert your router in portable network attack device.
In this article I will explain how it is possible to convert any OpenWrt compatible router to a Hak5 Shark Jack device, effectively turning it into your very own portable network attack device!
A hidden web shell in the plug-in wireless Planex MZK-DP150N | CVE-2021-37289
During my last vacation soaking up the sun in Okinawa, I stayed at a beautiful hotel right by the sea. One morning while having breakfast, I noticed that my hotel room had a small plug-in wireless LAN router from Planex. This device let guests share the hotel's internet connection by creating a private WiFi hotspot for each room. Pretty useful for avoiding network spoofing!
Simple Cipher - CTF Challenge
For this challenge we’re given the following string to decode:
Hackermon - CTF Challenge
This new challenge is based on the re-code of the Pokemon battle interface. To get the flag we must catch all 150 pokemon. Problem, we only have 99 pokeball’s in our inventory.
Hacker Kombat (THE GAME) - CTF Challenge
For this challenge as the description tells us, we should “Win an unwinnable game to receive the flag!” And it also says, “The developer has left in some bugs!”
Zipper - CTF Challenge
For this challenge we can download an image called "zipper_1_.jpg". I immediately think that might be probably a steganography challenge (Art of hiding data in image).
Triva Unsecured - CTF Challenge
For this challenge, a web page with several access points are displayed. When we click on one of the access points it seems that we are connected to it. The username and password are the web administration interface of the router (aka 192.168.x.x).
Secure any URL or Qr Code with a password!
Knil.click is a platform that respects the privacy of their users and allows you to encrypt and secure URLs or Qr Codes with a password.
Pug a Plenty - CTF Challenge
In this challenge we are asked to pet a dog several times in a very short period (only a few seconds) to get the flag.
Not So Simple Cipher - CTF Challenge
For this challenge we have a file that contains a long string of characters. After analysis of the string I could determinate that the string is in hexadecimal.
I Love Listings - CTF Challenge
For this really easy challenge we can download a compressed zip file called "CTF_1.zip". Let’s extract it and open it.
Flask Task - CTF Challenge
On this challenge, the platform seems to be an e-commerce website. The homepage displays only 3 buttons (source code, e-shop and reset).
Damn Cheap Cipher 2 - CTF Challenge
For this challenge we have a file that contains the following string:
CTF Flag Mart - CTF Challenge
For this challenge we are asked to become admin to get the flag, information that can be checked on the page service.html where the sentence "If you were 'admin' there'd be a pretty flag right here" is showed.
Crack Me 2 - CTF Challenge
For this challenge we can download a compiled C file called "crackme2_1.out". When I execute the file, a simple addition of 3 numbers, randomly generate, is required to get the flag. The problem is that we only have 1 second to complete and enter the right result... This is just impossible! I started like the Crack Me 1 challenge and used the command "strings" to display the hard-coded text…
Crack Me 1 - CTF Challenge
For this challenge we can download a compiled C file called "crackme1_1.out". When I execute the file, a password seems to be required to retrieve the flag.
Bob’s Cap - CTF Challenge
For this challenge we can download a packet capture file called "bob_1.pcapng". Let’s open it using the network analyzer tool, Wireshark.
Emoji - CTF Challenge
For this challenge a JavaScript file is provided. Once opened, tons of emojis appear.