# BITSCTF2024 Conquest Web Challenge

# **INTRODUCTION**

Greetings fellow hackers! 👋 I'm cyb4x a budding cybersecurity enthusiast. While I might still be finding my way around the vast landscape of cybersecurity, my passion for learning and exploring the intricacies of web exploitation has brought me to the BITSCTF 2024.

In this write-up, we'll embark on a deep dive into a web challenge that tested my problem-solving skills and pushed me beyond my comfort zone.

# **Challenge name: Conquest**


The journey begins with a simple link provided as the gateway to the mysterious web challenge. Clicking on the link led me to a webpage that became the canvas for our adventure.
At first glance, the page seemed ordinary, but my budding curiosity told me there was more beneath the surface.


With eager anticipation, I rolled up my sleeves and began to inspect the elements on the page, peering into the source code for any hidden clues or hints that could set the wheels of discovery in motion.But i found nothing interesting.

# **Unveiling Hidden Paths**

I decided to broaden my exploration by switching into the realm of hidden files and directories. Fuzzing, a technique where we systematically test different paths in the hopes of discovering concealed treasures, became my next line of attack. Embracing a tool well-suited for such endeavors, I turned to **dirsearch**—a reliable companion in the world of Capture The Flag challenges.

Dirsearch diligently scanned the digital landscape, probing for any signs of obscured pathways. It wasn't long before the tool unearthed an intriguing file—**robots.txt**.

# **Exploring the Unknown**

Excitedly, I checked out the robots.txt file in my browser, and there it was - a cool found! It said something about **/tournament**.


So, I navigated on it to see what's hiding there.

As the new page loaded, I felt like an adventurer stepping into a hidden cave. What would I find inside this **/tournament** place? The screen revealed it and my journey into this secret folder had officially begun.

# **The Challenge Unveiled**


The **/tournament** page welcomed me with a digital proclamation: *"Welcome to the Arena, Player! Beat our knights by slaying the dragon the fastest and obtain the secret scroll as a gift. The dragon's portal lies among some of the well-known paths traversed by men."*

Eager to embark on this virtual quest, I scrutinized the page, clicking around, checking page sources, and inspecting elements. Despite my efforts, the elusive dragon remained hidden, and the secret scroll remained just out of reach.

Undeterred, I revisited my trusty tool—**dirsearch**—to resume the hunt for hidden directories. Sometimes, the path to victory lies in persistence, and armed with newfound determination, I began fuzzing the server once again, hoping to unveil the dragon's portal among the familiar paths hinted at on the page.


# **Unraveling the Mystery**

In my exploration, dirsearch pointed me to another hidden path: **/tournament/humans.txt.** Excitedly, I navigated on it, expecting to find a file that could provide more clues.

To my surprise, instead of a simple text file, a new page unfolded before me. It was as if this path held more than just words; it was a page with its own secrets waiting to be discovered.


# **Facing the Challenge**
I found myself staring at a page that went beyond a simple text file. The /tournament/humans.txt page boasted a button named "Fight the Beast." Without hesitation, I clicked it, eager to confront the digital dragon.
So, after clicking the **"Fight the Beast"** button, I got taken to a new place called **/legend**. But there was a hiccup – instead of a warm welcome, it said, **"Too Slow. Try Again!" Oops!**

This message meant I needed to speed things up. It felt like the dragon was testing my quick reflexes. No time to waste! I took a moment, geared up for another try, and braced myself for the next round.


# **Outsmarting the Dragon**

Faced with the challenge of speed, I put on my detective hat and started snooping around the page. A peek into the page source turned out to be the key moment. There, I stumbled upon something interesting—a form hiding in plain sight.


This form was no ordinary one; it had a sneaky hidden input named **"slay"** with a value of **"1582510775.828625"**. Now, armed with this newfound information, I hatched a plan to outsmart the dragon.

I brought out my secret weapon, **Burp Suite**, and intercepted the request. It was time to tweak the values, dance with the dragon's server, and hopefully, emerge victorious in the battle against time.

# **Playing the Game and Conquering the Dragon**


With the intercepted request in hand, I navigated to Burp Suite's trusty **Repeater** tool. It was time to play with the numbers, a digital dance to outwit the dragon's timer.

The hidden input named **"slay"** held the **key**, and I began tweaking its value. A delicate balance of timing and precision, each adjustment brought me closer to the optimal moment—the sweet spot to slay the dragon at lightning speed.

In my relentless pursuit to outpace the dragon's speed, I took a bold step and manipulated the value to a larger number. It was a gamble, a calculated risk in the dance with time. And then, **BOOM! Success** echoed through the virtual realm.

The dragon, once seemingly unbeatable, succumbed to my strategic maneuvers. The Burpsuite response displayed a triumphant message—it was the coveted **flag**, the symbol of **victory** in the world of Capture The Flag challenges.


# **Conclusion**
To everyone who joined me on this adventure, thank you for sharing in the excitement of my first-ever CTF challenge write-up. I'm just a beginner, learning the ropes, so if anything seemed a bit odd, I appreciate your understanding.

This is just the beginning of my journey into the world of cybersecurity challenges, and I promise more articles to come. Stay tuned for more tales of exploration, puzzles, and victories as I continue to navigate this fascinating landscape.

Thank you for being a part of my beginner's adventure wishing you happy hacking, and I look forward to sharing more with you soon!