Played with @blackb6a, challenge solved by ozetta, write up by vow. Challenge Summary With all this hype around jwt, I decided to implement jason web tokens to secure my OWN jason fan club site. Too bad its not in haskell. Website: jwt.chall.lac.tf Step 0: Messing around The website generates a "jason web token" using our inputted name and age:

Played with @blackb6a, solved by vow, YMD and ozetta. Challenge Summary Can you help us discover the secret hidden within this AI chatbot? Note: Brute-force is not allowed. Server: https://chat.tienbip.xyz :::spoiler Hint 1

Hi, I am vow. I participated IRIS CTF 2024 and played with Black Bauhinia. I tried to make this write up as beginner friendly as possible so that everybody can follow and learn something. Special thanks to harrier, hollow, TheHakkaman and th1k4n for solving the challenges with me. Part 1: What is, and how to OSINT? OSINT is a new category added to IRIS CTF this year. So, what is OSINT? :::info

Step 0: Reconnaissance We have a file called "White & Blank". We don't know what type of file it is, and nothing seems interesting in the file's metadata, so let's take a look with a hex editor. For me, I used HexEd.it: image We see that some of the bytes translate to some text, Googling the text will show that the file is in a format called OpenEXR[^1] (Might have to scroll down a bit or add more keywords): image So, now we know it is an .EXR file, how to do we open it?