---
# System prepended metadata

title: picoCTF 2024 Write up

---

## WebDecode
題目說明
> Description
Do you know how to use the web inspector?
Start searching here to find the flag

> Hint 1：Use the web inspector on other files included by the web page.
Hint 2：The flag may or may not be encoded

![image](https://hackmd.io/_uploads/rkLsMuxaC.png)

![image](https://hackmd.io/_uploads/BJehzdeTR.png)
About 頁面好像可能有我們要找的 flag，按 F12，檢查頁面，發現一個奇怪的東西
![image](https://hackmd.io/_uploads/Hk_zXdxaC.png)
notify_true 這邊有一串字串，加上前面的提示寫說可能有編碼，因此丟到 Cyberchef 裡面看
字串
```
cGljb0NURnt3ZWJfc3VjYzNzc2Z1bGx5X2QzYzBkZWRfMWY4MzI2MTV9
```
![image](https://hackmd.io/_uploads/ry9Im_gpC.png)
一開始先猜是不是 Base64，flag就出來了，此提結束
`picoCTF{web_succ3ssfully_d3c0ded_1f832615}`
## Unminify
> Description
I don't like scrolling down to read the code of my website, so I've squished it. As a bonus, my pages load faster!
Browse here, and find the flag!

> Hint 1：Try CTRL+U / ⌘+U in your browser to view the page source. You can also add 'view-source:' before the URL, or try curl URL in your shell.
Hint 2：Minification reduces the size of code, but does not change its functionality.
Hint 3：What tools do developers use when working on a website? Many text editors and browsers include formatting.

首先，進去後網頁長這樣
![image](https://hackmd.io/_uploads/BJnw8ux6A.png)
寫說 flag 已經載入了
前面又說開發者最常用的工具是什麼?
於是一樣先開啟 F12
馬上看到 flag
![image](https://hackmd.io/_uploads/rJElvOgp0.png)
答案
`picoCTF{pr3tty_c0d3_b99eb82e}`
此題結束

## IntroToBurp

> Hint 1：Try using burpsuite to intercept request to capture the flag.
> Hint 2：Try mangling the request, maybe their server-side code doesn't handle malformed requests very well.

一進來是個網頁
![image](https://hackmd.io/_uploads/HkGR1tlTC.png)
先隨便打點東西進去
又因為前面寫說要用 Burp 攔截 request
所以先隨便打點東西進去
![image](https://hackmd.io/_uploads/S1JNxFga0.png)
攔截後，內容如下
![image](https://hackmd.io/_uploads/B1MBlYeaR.png)
看到 cookie 以及 csrf，想說是不是與 csrf 相關
所以先把這段 token 複製下來
```
IjFiNTNiYjAyNzU4MTA1ZWMzZDM1NzczZWNhOGU3YTRkNmJjNDY2NDQi.ZuL_tw.dMgdCf_WbQQOuDS9yRRg2IMV7Qc
```
接著 Forward，先看下一步是什麼
出現說要二步驟驗證
![image](https://hackmd.io/_uploads/S1ojlFx60.png)
於是，再隨便輸入點東西進去，一樣攔截 request
![image](https://hackmd.io/_uploads/r1y0xFgaA.png)
繼續下去，看會出現什麼
![image](https://hackmd.io/_uploads/HkCe-KgpA.png)
出現 Invalid number
於是回到剛要輸入二步驟驗證那邊，想說會不會是要拿 csrf token 蓋過去
於是替換成剛剛複製下來的
![image](https://hackmd.io/_uploads/BJGPbtx6C.png)
但卻發現會退回一開始的地方
![image](https://hackmd.io/_uploads/HyWo-FxTR.png)
後來還想說再送出一開始的表單時，把 cookie 也換成 csrf token
![image](https://hackmd.io/_uploads/r12yfKeT0.png)
但看起來沒效果，他會返回一開始的表單

後來再二步驟驗證那邊，想說如果把 otp 的值拿掉呢?
畢竟前面有說可以改 request 
![image](https://hackmd.io/_uploads/HyyIMFlTR.png)
結果一樣是 Invalid number
後來實在不知道怎麼辦
乾脆整組 otp 拿掉
![image](https://hackmd.io/_uploads/HkMczFx6R.png)
恩...結果 flag 就出來了
好吧
`picoCTF{#0TP_Bypvss_SuCc3$S_6bffad21}`
此題結束

## Bookmarklet
> Why search for the flag when I can make a bookmarklet to print it for me?
Additional details will be available after launching your challenge instance.

> Hint 1：A bookmarklet is a bookmark that runs JavaScript instead of loading a webpage.
> Hint 2：What happens when you click a bookmarklet?
> Hint 3：Web browsers have other ways to run JavaScript too.

一進來看到一個網頁，並且附有 JavaScript
![image](https://hackmd.io/_uploads/B1eYtCWpA.png)
於是下意識先打開 F12，並且切到主控台
![image](https://hackmd.io/_uploads/BJsaFCZpR.png)
輸入剛那串
![image](https://hackmd.io/_uploads/SkiRFCbpC.png)
![image](https://hackmd.io/_uploads/SkXl9C-6A.png)
得到 Flag
`picoCTF{p@g3_turn3r_0c0d211f}`
此題結束

## Local Authority
> Can you get the flag?
Additional details will be available after launching your challenge instance.

> Hint 1：How is the password checked on this website?

進來時是一個登入畫面
先輸入一些東西試試看
![image](https://hackmd.io/_uploads/S1w3Jkz6A.png)
並且因為 Hint 的內容看起來是要使用 inspector，因此打開 F12
![image](https://hackmd.io/_uploads/SyMxbJz60.png)
看起來沒什麼問題
因此繼續
![image](https://hackmd.io/_uploads/Hyn-ZJMTR.png)

出現 Log In Failed
但還是先按 F12 檢查看看
![image](https://hackmd.io/_uploads/HJMUbJzTC.png)
發現有個 hidden 的東西
既然發現有隱藏的東西，當然是要拿掉來，看看裡面是什麼
因此把它拿掉
![image](https://hackmd.io/_uploads/HyJczkf6R.png)
同時發現底下有個 JavaScript
於是打開來看一下
發現 loggedIn 的地方，有個 adminFormHash 的值，看起來就很可疑，因此複製下來
![image](https://hackmd.io/_uploads/ByKlQ1z6R.png)
```
2196812e91c29df34f5e217cfd639881
```
拿掉表單的 hidden 之後，發現多了一個輸入框
![image](https://hackmd.io/_uploads/rktv71fa0.png)
又看到表單目的是 admin，因此覺得這個輸入框與剛剛 adminFormHash 的值有相關，因此把值打進去按下 Enter
![image](https://hackmd.io/_uploads/Hku0m1G6A.png)
果然，flag 出現了
![image](https://hackmd.io/_uploads/H12JVJzp0.png)
`picoCTF{j5_15_7r4n5p4r3n7_a8788e61}`
此題結束

## Inspect HTML
> Can you get the flag?
Additional details will be available after launching your challenge instance.
> Hint 1：What is the web inspector in web browsers?

進來網站長這樣
![image](https://hackmd.io/_uploads/HJngB1f6C.png)
因為 Hint 說要用 inspector，所以一樣按 F12 來檢查
![image](https://hackmd.io/_uploads/r1bIHkfa0.png)

結果馬上就出現
`picoCTF{1n5p3t0r_0f_h7ml_8113f7e2}`
此題結束


## Includes
> Can you get the flag?
Additional details will be available after launching your challenge instance.

> Hint 1:Is there more code than what the inspector initially shows?

一進去網頁長這樣
![image](https://hackmd.io/_uploads/r1qhB-7p0.png)
先按一下 F12 看 inspector 裡面有什麼
![image](https://hackmd.io/_uploads/r12Z8bQT0.png)
看起來沒什麼可疑的
因此點一下網頁上的按鈕
跳出通知
![image](https://hackmd.io/_uploads/HkYmLZXaR.png)
看到說在別的檔案裡
於是馬上想到來源的地方
點進去看，發現兩個檔案
![image](https://hackmd.io/_uploads/r1HL8WXTR.png)

都點進去看
第一個 script.js 裡面長這樣
![image](https://hackmd.io/_uploads/S1p_LWQ6R.png)
看起來有像 flag 的東西
先記下來
```
f7w_2of2_b8f4b022} f7w_2of2_b8f4b022}
```
接著點下一個，style.css
![image](https://hackmd.io/_uploads/SJQoLbXT0.png)
發現有另外一段 flag
```
picoCTF{1nclu51v17y_1of2_
```
於是組合在一起，flag 就出現了
`picoCTF{1nclu51v17y_1of2_f7w_2of2_b8f4b022} f7w_2of2_b8f4b022}`
此題結束

## Cookies
> Who doesn't love cookies? Try to figure out the best one. http://mercury.picoctf.net:27177/
> 