---
# System prepended metadata

title: 'LKS SMK TELKOM MAKASSAR 2025 CYBER SECURITY: COMPETITION OF THE EARNEST EXPERTISE WRITE-UPS'

---

# LKS SMK TELKOM MAKASSAR 2025 CYBER SECURITY: COMPETITION OF THE EARNEST EXPERTISE WRITE-UPS

Greetings, welcome to my LKS SMK TELKOM MAKASSAR 2025 CYBER SECURITY: COMPETITION OF THE EARNEST EXPERTISE write-ups. This is an inner CTF event that was organized by my school to qualificate to the LKSN 2025. The categories on this CTF are mainly web exploitation with some cryptography and miscellanous challenges.


## Table of Contents
1. Miscellanous
    a. SANITY
    b. Tebak-Tebak

2. Cryptography
    a. -- --- .-. ... . (Morse)
    b. Piano..
    c. Rel
    d. XV
    
3. Web Exploitation
    a. Danantara
    b. Flag_store
    c. Fufufafa
    d. Javascript Object Notation
    e. Judol - Kids version
    f. One Time Password
    g. STELKERS
    h. SendTheSong
    i. Structured Query Language?
    j. Structured Query Language
    
## 1. Miscellanous
### a. SANITY
![Challenge Page](https://hackmd.io/_uploads/BJqJDdU0yx.png)
The competition fields that I enrolled for this LKS event is Cyber Security. Wrap it inside the given flag format and you're good to go.

Flag:
LKS{Cyber_Security}


## b. Tebak-Tebak
![Challenge Page](https://hackmd.io/_uploads/SJHD__ICkg.png)
Given the *ssh* credentials for this challenge. I went to Kali Linux and entered the provided credentials.

Sadly, I do not have the image to show you for this challenge since I forgot to capture the image of the processes. But I will break it down for you.

In this challenge, you have to guess a numbers from the range of 1 - 1000 in only 10 guesses. Every time you restart the instance, the numbers you have to guess will be randomized.

I solved this by starting with a guess of 500, a good balance in between high or low numbers. I remembered that it said higher. So then I tried 900, and it said higher again. But when I entered 950, it said lower.

I guessed and I guessed until at my last guesses attempt, I finally guessed the correct randomized numbers, in which, if I remembered correctly, was 924.

Flag:
LKS{did_u_guess_or_calculate_it?}



## 2. Cryptography
### a. -- --- .-. ... . (Morse)
![Challenge Page](https://hackmd.io/_uploads/Hy20FtLCyx.png)
Just like the name, all you have to was to decode this morse code into a plaintext. I used cryptii.com as always since it's very simple and convenient.
![Step 1 (Decoding the Morse Code)](https://hackmd.io/_uploads/HkfR5t8R1x.png)
As you can see, at the end of the sentences, there was an unwrapped flag with a format of "lks". So, I wrapped the flag inside the default format of this event flag.

Flag:
LKS{iloveandhate_pramuka}


### b. Piano..
![Challenge Page](https://hackmd.io/_uploads/HyvshY801g.png)
This is a music sheet cipher. To decode this, I used dcode.fr since it has a music sheet cipher decoder.
![Step 1 (Decrypting the Music Sheet Cipher)](https://hackmd.io/_uploads/SJo36YI0Je.png)
Given the decoded plaintext, there was a flag with "LKS" in front of it. I wrapped the flag inside the default format of this event flag.

Flag:
LKS{ILOVEPIANO}


### c. Rel
![Challenge Page](https://hackmd.io/_uploads/SyaYRKLCyg.png)
The descriptions of this challenge gave us a very specific hint of what kind of cipher this text was. It said that the author's friend has been talking all day about a train and a "rail". Noticing the word rail, I immediately realised that this was a railfence cipher.

I used cryptii.com to decode this railfence cipher, and this is what I got.
![Step 1 (Decoding the Railfence Cipher)](https://hackmd.io/_uploads/r1vYJ9UCyx.png)

Flag:
LKS{Rel_kereta_api}


### d. XV
![Challenge Page](https://hackmd.io/_uploads/Sy6fxqIRke.png)
Here is the full decoded text provided in the description.
```
Vm0wd2QyUXlVWGxWV0d4V1YwZDRWMVl3WkRSV01WbDNXa1JTV0ZKdGVGWlZiVFZyVmxVeFYyTkljRmhoTVhCUVZqQmFZV015U2tWVWJHaG9UV3N3ZUZacVFtRlpWMDE1VTJ0V1ZXSkhhRzlVVm1oRFZWWmFkR1ZHV214U2JHdzFWa2QwYzJGc1NuUmhSemxWVm0xb1JGWldXbUZqVmtaMFVteHdWMDFWY0VwV2JURXdZVEZrU0ZOclpHcFNWR3hoVm1wT1UxSXhjRlpYYlVacVZtdGFNRlZ0ZUZOVWJVWTJVbFJHVjFaRmIzZFdha1poVjBaT2NtRkhhRk5sYlhoWFZtMHdlR0l4U2tkWGJHUllZbFZhY2xWcVFURlNNVlY1VFZSU1ZrMXJjRmhWTW5SM1ZqSktWVkpZWkZkaGExcFlXa1ZhVDJNeFpITmhSMnhUVFcxb1dsWXhXbXROUjFGNVZXNU9hbEp0VWxsWmJHaFRWMFpTVjJGRlRsTmlSbkJaV2xWYVQxWlhTbFpqUldSYVRVWmFNMVpxU2t0V1ZrcFpXa1prYUdFeGNGbFhhMVpoVkRKTmVGcElUbWhTTW5oVVZGY3hiMWRzV1hoYVJGSnBUV3RzTlZadE5VOVdiVXBIVjJ4U1dtSkhhRlJXTUZwVFZqRndSMVJyTlZOaVJtOTNWMnhXYjJFeFdYZE5WVlpUWWtkU1lWUlZXbUZOTVZweFUydDBWMVpyY0ZwWGExcDNWakZLVjJOSWJGZFdSVXBvVmtSS1QyTXlUa1poUjNCVFlYcFdXVlpYY0U5aU1XUnpWMWhvWVZKR1NuQlVWbHBYVFRGU1ZtRkhPVmROVjFKSldWVmFjMWR0U2toaFJsSlhUVVp3VkZacVJtdGtSa3AwWlVaa2FXRXdjRWxXYlhCTFRrWlJlRmRzYUZSaE1sSnhWV3RXUzJGR1ZYZGhSVTVUVW14d2VGVnRNVWRWTWtwV1ZtcGFXbFpXY0doWlZXUkdaVWRPU0U5V2FHaE5WbkJ2Vm10U1MxUXlUWGxVYTFwaFVqSm9WRlJYTVc5bGJHUllaVWM1YVUxWFVucFdNV2h2V1ZaS1IxTnVRbFZXYkhCWVZGUkdVMVp0UmtoUFZtaFRUVWhDU2xac1pEUmpNV1IwVTJ0b2FGSnNTbGhVVlZwM1ZrWmFjVkp0ZEd0V2JrSkhWR3hhVDJGV1NuUlBWRTVYVFc1b1dGZFdXbEpsVmtweVdrWm9hV0Y2Vm5oV1ZFSnJUa1prUjFWc1pGaGhNMUpVVlcxNGQyVkdWbGRoUnpsb1RWWndlbFl5Y0VOWGJGcFhZMFJPV21FeVVrZGFWV1JQVWxaa2MxcEhiRmhTVlhCS1ZtMTBVMU14VlhoWFdHaFlZbXhhVjFsc1pHOVdSbXhaWTBaa2EwMVdjRmxhVldNMVZXc3hXRlZzYUZkTlYyaDJWMVphUzFKc1RuUlNiR1JwVjBVME1GWkhkR0ZoTWs1elYyNVNhMUp0YUZSVVZXaERUbFphU0dWSFJtcE5WMUl3VlRKMGIyRkdTbk5UYlVaVlZteHdNMXBYZUhKbFZURldXa1pPYVZKcmNEWldhMk40WXpGVmVWTnVTbFJpVlZwWVdWUkdkMkZHYkhGVGExcHNVbTFTZWxsVldsTmhSVEZ6VTI1a1YxWXpVbWhWZWtaYVpVWldjMkZGT1ZkaGVsWjZWMWQwWVdReVZrZFdXR3hyVWtWS1dGUldXbmRsVmxsNVpVaGtXR0pHY0ZoWk1HaExWakpHY2xkcmVGZE5WbkJJV1RJeFIxSXlSa2hpUms1cFUwVktNbFp0TVRCVk1VbDVVbGhvWVZKWFVsZFpiWFIzWVVaV2RHVkZkR3BTYkhCNFZUSXdOV0pIU2toVmJHeGhWbGROTVZsV1ZYaGpiVXBGVld4a1RtRnNXbFZXYTJRMFV6RktjMXBJVmxSaVJscFlXV3RhZG1Wc1pITlhiVVpXVFZac05GWXlOVk5oTVVwMFZXNUNWMkpIYUVSVk1WcGhZMVpPY1ZWc1drNVdNVWwzVmxSS01HSXlSa2RUYms1VVlrZG9WbFp0ZUhkTk1WbDNWMjVLYkZKdFVubGFSV1IzWVZaYWNtTkZiRmRpUjFFd1dWUktSMVl4Y0VaYVJrNW9Za2hDV1ZkWGVGTlNhekZIVjJ4V1UySklRbk5WYlRGVFYyeGtjbFpVUmxkTmEzQllWVEkxYjFZeFdYcGhTRXBYVmtWYWNsVnFSbGRqTWtaR1QxWmtWMVpHV2pKV2JHTjRUa2ROZDAxSWFGaFhSM2hQVm14a1UxWXhVbGhrU0dSVFRWWktlbFpYZEU5WFIwcEhZMFpvV2sxR1NsQldNbmhoVjBaV2NscEhSbGRXTVVwUlZsUkNWazVXV1hoalJXUmhVbXMxV0ZZd1ZrdE5iRnAwVFZSQ1ZrMVZNVFJXVnpWVFZqSktTRlZzVmxwaVdGSXpXV3BHVjJOV1RuUlBWbVJUWWxob05WWnRNREZoTVZsNFYyNU9hbEpGU2xaV2JGcExVMFphV0dNemFGaFNiRnA1V1ZWYWExUnRSbk5YYkZaWFlUSlJNRmxVUms5U01WcDFWR3hvYVZKc2NGbFdSbEpIVXpBMWMxZHJhR3RTTUZwWldXeGFZVk5XVm5Sa1J6bFdVbXhzTlZsVmFFTldiVXBJWVVWT1lWSkZXbWhaZWtaM1VsWldkR05GTlZkTlZXd3pWbXhrTkdJeVNYaFhXR2hoVWxkb2IxVnFRbUZXYkZwMFpVaGtUazFZUWxsYVZXaExZa1paZUZkcmNGaGhNWEJRVmtkNFlXTnRUa1ZXYkdSVFRUSm9iMVpyVWt0U01WbDRWRzVPWVZJeWFFOVVWM2hMVjFaa1dHVkhPVkpOVlRFMFdUQmFZVll4WkVoaFJsSlZWbTFTVkZwWGVITldiR1J6Vkcxb1YyRXpRWGhXVm1NeFlqRlplRmRZY0doVFJuQlhWbXRXWVZsV2NGWlhiWFJyVm10d2VsWnRNWE5XTVVsNllVWndWMkpIVGpSVWEyUlNaVlphY2xwR1pHbGlSWEJRVm0xNGExVXhaRWRWYkZwV1lUSlNjMVp0ZUV0bGJGcDBUVVJXVjAxRVJsZFpibkJMVm0xS1dWVnVXbGRoYTFwb1ZXMTRhMk50VmtkYVIyaG9UVEJLVWxac1kzaE9SbXhZVkZob2FsSlhhSEJWYlhNeFZERmFjMWRzY0d4aVJuQXdXbFZrUjFack1WWmlSRkphWVRGd2NsWXdaRXRqYlU1R1QxWmthVmRIWjNwV2FrSmhZekZrV0ZSclpHRlNiVkpVV1d0YWQwNVdXblJOVkVKYVZteEdORlp0ZUZkVWJFcElZM3ByUFE9PQ==
```
As you can see at the end of the code, there was a double equal, which means that this was a "Base64" encoded text.

So, I used CyberChef to perform a multiple Base64 decode since this encoded Base64 text looked too long if it's only decoded 1 time.
![Step 1 (Decoding the Base64 Cipher)](https://hackmd.io/_uploads/SyXLE9LCke.png)
The "XV" in the title of this challenge represents the amount of decoding you have to do, which was 15 times.

Flag:
LKS{Dont_know_what_toaddsoilovebase64XV}



## 3. Web Exploitation
### a. Danantara
![Challenge Page](https://hackmd.io/_uploads/rkcjtsI0kl.png)
This challenge gave you a vulnerable website without telling you what kind of vulnerability was inside of it. As you can see, the hint said that you have to look at the "publication" section to find the secret.
![Publication Section Page](https://hackmd.io/_uploads/BkXY5vdRJl.png)
I clicked the link and quickly observe the traffic at the "publication" section using BurpSuite.
![Step 1  (Observing the Publication Section Traffic)](https://hackmd.io/_uploads/HJ8acv_RJe.png)
Nothing seems fishy. But what if I clicked the documents?
![Step 2 (Observing the Document Section Traffic)](https://hackmd.io/_uploads/rkWmsvdAkl.png)
The endpoint "baca" and the parameter "dokumen" looked like a vulnerability named *LFI (Local File Inclusion)*. In which, if you type "../../../etc/passwd", it will reveals the lists of all user accounts on the Linux system.

I typed the command below and this is what I got.
![Step 3 (Testing the Vulnerable Endpoint and Parameter)](https://hackmd.io/_uploads/S1N6hwuA1e.png)
It's an *LFI* vulnerability indeed.

Last step was to tried typing "flag.txt" to see if I can get anything.
![Step 4 (Typing flag.txt)](https://hackmd.io/_uploads/BJ2G6DuRye.png)
There it is. Took me 3 hours to solve this challenge.

Flag:
LKS{unconvered_mysteries}


### b. Flag_store
![Challenge Page](https://hackmd.io/_uploads/H1BcaPd0ye.png)
This is the challenge page.

By clicking the link, it led me to a shopping-like website.
![Step 1 (Observing the Website)](https://hackmd.io/_uploads/SyslRv_0yg.png)
It said that there was a "Super Secret Flag". Hmm, seems fishy enough.

I added it to the cart and clicked the checkout link while the intercept on my BurpSuite was on to observe the incoming traffic andd analyze it.
![Step 2 (Observing the Checkout Traffic)](https://hackmd.io/_uploads/SkiDRP_RJg.png)
It said "Insufficient balance". Well, of course, since I only have 1000 credits while the price of that "Super Secret Flag" was 999999 credits. But as you can see on the right at the last code, there is something that said "discount: 0".

I tried to manipulate it into "discount: 999999" to see if it worked. And turns out, it was.
![Step 3 (Manipluating the Code)](https://hackmd.io/_uploads/Sk9XJduRJg.png)

Flag:
LKS{m4ss_4ss1gnm3nt_4nd_l0g1c_3rr0r_1s_b4d}


### c. Fufufafa
![Challenge Page](https://hackmd.io/_uploads/rkapJOORkg.png)
Given the challenge description that we have to breach the security questions of an account with a username of "fufufafa". It also said that this challenge was a combination of web exploitation and an OSINT. Interesting.

I clicked the link and observe the page.
![Step 1 (Observing the Website Page)](https://hackmd.io/_uploads/H1JOxd_01l.png)
Nothing interesting on the main page. So I clicked the "login" and this is what I got.
![Step 2 (Login Page)](https://hackmd.io/_uploads/H10nluuCJx.png)
I clicked the "forget password" in order to breach the account.
![Step 3 (Username Page)](https://hackmd.io/_uploads/BkYWbuOC1x.png)
Given the username "fufufafa" that we have to breach, I entered it.
![Step 4 (5 Letter of His Email)](https://hackmd.io/_uploads/By_I-uO01l.png)
It said that we have to enter the first 5 letter of his email. It's time to do the research.

The username "fufufafa" publicly rumoured as an account of our current Vice President of Indonesia, Mr. Gibran Rakabuming Raka. So, I searched on Google about "fufufafa email", and to my surprise, it quickly shown me the email information of this "fufufafa" account.
![Step 5 (Finding the Leaked Email)](https://hackmd.io/_uploads/BJ0jGOO0yg.png)
So, the first 5 letter was "chili". But there was a slight error on the website, so it was "chilli" instead.

Next question was about 5 last number of his handphone.
![Step 6 (Last 5 Number of His Handphone)](https://hackmd.io/_uploads/SJIVXuORke.png)
I searched on Google again about "fufufafa handphone number", and this is what I found.
![Step 7 (Finding the Leaked Handphone Number)](https://hackmd.io/_uploads/BkmEEduC1l.png)
The last 5 number of his handphone was "28233". I entered it on the website and this was the next question.
![Step 8 (His Middle Name)](https://hackmd.io/_uploads/Skd_E_dA1x.png)
His middle name was "Rakabuming".

After entering all the needed questions, the server got an error.
![Step 9 (Internal Server Error)](https://hackmd.io/_uploads/HJlpNO_AJx.png)
So, the supervisor send me the flag through Telegram instead.
![Step 10 (Final Flag)](https://hackmd.io/_uploads/Hyq-ruuRke.png)

Flag:
LKS{j3j4k_d1g1t4l_s3l4lu_m3mb3k4s}


### d. Javascript Object Notation
![Challenge Page](https://hackmd.io/_uploads/H1BcSuO0kx.png)
It said that this challenge was about *JSON*.

I clicked the website and observed it.
![Step 1 (Observing the Website)](https://hackmd.io/_uploads/B1YNIOuAyl.png)
![Step 1.1 (Observing the Website)](https://hackmd.io/_uploads/SJtV8d_Akg.png)
![Step 2 (The Challenge)](https://hackmd.io/_uploads/ByY4LOdR1l.png)
The challenge just wanted you to correct the provided JSON below like the example.

After correcting the JSON, I got the flag.
![Step 3 (Corrected JSON)](https://hackmd.io/_uploads/Sk95U_uRkx.png)

Flag:
LKS{j50n_m4st3ry_4ch13v3d}


### e. Judol - Kids version
![Challenge Page](https://hackmd.io/_uploads/HJOzAJFAkg.png)
Given a gambling-like website like this.
![Website Page](https://hackmd.io/_uploads/H12iR1FAJe.png)
I analyzed the source code, and this is what I found.
![Step 1 (Analyzing the Source Code)](https://hackmd.io/_uploads/BJPeJgYR1l.png)
![Step 1.1 (Analyzing the Source Code).png](https://hackmd.io/_uploads/rJPlyet0Je.png)
This looked like it can be manipulated. So, I went to BurpSuite and analyze the traffic.

I turned the intercept on when I clicked spin, and this was the upcoming traffic that I intercepted.
![Step 2 (Analyzing the Upcoming Spin Traffic)](https://hackmd.io/_uploads/By9DyxtCkx.png)
A jackpot can be obtained by changing all the reels to "100".
![Step 3 (Manipulating the Upcoming Spin Traffic).png](https://hackmd.io/_uploads/H1TYklF01l.png)
I did this for 10 times, and I got the flag.
![Step 4 (Final Flag)](https://hackmd.io/_uploads/BycRkltAJg.png)

Flag:
LKS{jangan_main_judol_ya_janganyadekyayaya}


### f. One Time Password
![Challenge Page](https://hackmd.io/_uploads/BJ1-_xYAkl.png)
Given a login page website with an OTP authentication in it.
![Website Page](https://hackmd.io/_uploads/HyvMtxtAkx.png)
I entered the provided credentials and analyzed the traffic in BurpSuite history.
![Step 1 (Finding the OTP Code)](https://hackmd.io/_uploads/BJ7wYgF01g.png)
By entering the code, you got the flag.
![Step 2 (Final Flag)](https://hackmd.io/_uploads/S1gqKxYR1g.png)

Flag:
LKS{mf4_byp4ss_th3_OTP_l34k}


### g. STELKERS
![Challenge Page](https://hackmd.io/_uploads/H1s4jgtAye.png)
This challenge requires you to analyze the traffic of this school website and obtain the informations needed in the descriptions.

I opened the website and logged in using my own credentials. Then I intercepted the traffic in BurpSuite to find something fishy. To my surprise, it's quite quick.
![Step 1 (Intercepting the Trafffic)](https://hackmd.io/_uploads/rkN20lt0Jg.png)
From here, I only need to obtain the private informations needed for each person and wrap it inside the flag format.

Flag:
LKS{544231149_544231133_12860034_21970020}


### h. SendTheSong
![Challenge Page](https://hackmd.io/_uploads/SyvugWKRkl.png)
Given a website that can send and view a song notes like this.
![Website Page](https://hackmd.io/_uploads/Hym3gWKR1l.png)
It was said that the ID could led to something. And yes, it was indeed.
![Step 1 (Looking at the Suspicious ID)](https://hackmd.io/_uploads/B1bxWZYC1x.png)
Note ID number 10 said that the ID validation has to be tightened. It was also said that I have to look for a specified ID.

After scrolling through each notes ID, I finally found the flag in the 100th ID.
![Step 2 (Final Flag)](https://hackmd.io/_uploads/BkEh-bYCJx.png)

Flag:
LKS{Uhavesendthesongforanflag}


### i. Structured Query Language?
![Challenge Page](https://hackmd.io/_uploads/H1be4-t0Jx.png)
It was said that this challenge used *NoSQL*, which means that *SQL Injection* method won't work.

I clicked the website and I got this login page.
![Website Page](https://hackmd.io/_uploads/SyWvE-F0ye.png)
I tried entering *SQL Injection syntax*, but it didn't work.

So, I searched on Google about how to breach the *NoSQL* login page using BurpSuite, and I found one on *Medium* that helped me.
![Step 1 (Searching Tips on Google)](https://hackmd.io/_uploads/ryUerWKA1g.png)
It said that the intercepted traffic on BurpSuite can be manipulated. And so, I did the same.
![Step 2 (Logged In But Not As an Admin)](https://hackmd.io/_uploads/SJlurbK0Je.png)
I logged in, but not as an admin.

I scrolled through the *Medium* post once again, and looked at the syntax commands.
![Step 3 (Syntax Commands)](https://hackmd.io/_uploads/Sy-CrWKRJx.png)
The problem was that I put "ne" at the "user", which meant "not equal to". In order to log in as an admin, I have to be the admin. So the correct syntax was "in" so that it matches the value of an "admin".
![Step 4 (Corrected Syntax)](https://hackmd.io/_uploads/rJtDL-YCJx.png)
By entering the corrected syntax, I found the flag.
![Step 5 (Final Flag)](https://hackmd.io/_uploads/SkAKIbYAJl.png)

Flag:
LKS{I_thought_there_was_only_SQL-Language_for_Databases}


### j. Structured Query Language
![Challenge Page](https://hackmd.io/_uploads/HyAlwbFCkx.png)
For this challenge, all you have to do was no an *SQL Injection* method into the login page.
![Website Page](https://hackmd.io/_uploads/BJG4wbYCkg.png)
Username: admin
Password: ' or '1'='1
![Step 1 (Final Flag)](https://hackmd.io/_uploads/BksvD-FAJg.png)

Flag:
LKS{SQL_1NJ3CT10N_L0G1N_BYP4SS_M4ST3R}