NahamCon CTF 2022: Web Challenge Walkthroughs 

thank you 🙏🥰

nope! i normally avoid crypto 😁

never 😆 it was a great CTF but I don't have time to cover all challenges, especially when there's multiple competitions every week. I typically either: a) pick a category b) solve easy-ish challs from multiple category c) pick 1-2 hard challenges angstrom CTF video is coming later today though, containing a few pwn challs 😉

ty 🥰 i wasn't planning to take down the video but youtube censors be warned!! 😀

@@_CryptoCat Calm down I've saved it in the gallery🤣

🙏🥰

thanks mate 💜

thanks mate 🥰 i definitely didnt win haha, just did a few challenges 😁

ty 🙏🥰

thanks mate 🙏🥰

💜

thanks 🥰 3:19 it said the flag was at /var/www so just had to guess filename, either "flag" or "flag.txt" 😁

No pwn this time! I solved a couple of the easier ones but they were very similar to videos I've made before.

thanks mate 💜

Thanks mate 🥰 No pwn challs from this CTF but there's *a lot* already on the channel 😉

​ @CryptoCat ​ yes already did watch them (good content === new subscriber :D), i did know this channel when i was trying to do babysteps challenge, still couldn't solve it 🙃

@@khalilbouzidi8432 there was a few ways to solve babysteps, i just used ret2libc which comes up a lot in CTFs although this was 32-bit, which is less common: github.com/Crypto-Cat/CTF/blob/main/ctf_events/nahamcon_22/pwn/babysteps.py

@@_CryptoCat I'm trying to learn more about pwn so thanks for the guidance

Yeh, that's typically the case with CTFs, no automated tools. They normally say that due to the infrastructure though. I think it makes a lot less sense as a rule when each player has their own instance. I guess the challenges are designed to be solved without brute force though 😅

@@_CryptoCat yeah I agree with that part. Brute forcing kinda take the beauty out of it to be honest, even though it does make it harder. Not gonna lie, dirb was always on my mind when I was attempting, and have to keep reminding myself haha. Thanks again for the video!

@@SuperSohaizai It really wasn't needed here, I just thought I'd include it in because it's one of the first things you'd do on a HTB machine, or in a real pentest. Knowing my luck people will do in CTF events now and get suspended for breaking rules: "😮 but I learnt it from CryptoCat?!" 🤣 Thank you! 🙏🥰

From the conference? Which presentation? I think they'll be uploaded to ru-vid.com

@@_CryptoCat i think you open the presentation while solving hacker T's challenge... may be its of defcon i guess

@@rehanmumtaz5972 oooooo I know what you mean! here it is: docs.google.com/presentation/d/1JdIjHHPsFSgLbaJcHmMkE904jmwPM4xdhEuwhy2ebvo/htmlpresent

@@_CryptoCat Thanks for sharing btw great explanation of these web challenges ! 💓

@@rehanmumtaz5972 💜

nandri 🙏🥰

nah haha a teammate solved it and i didn't have all that much time. I was just going to pick 1 hard chall.. then couldn't solve any and did a few web instead 😂 I struggled enough with some of the xss ones bc im a n00b 😆

@@_CryptoCat it's cool that u mention ur failures and ur successes bro !!

@@_CryptoCat no, you're pro D:

that one was cool! don't see it much in ctfs 😊