
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*l-uS6c2MsNOzzL1p.jpg"></figure><p>Forensics is the art of recovering the digital trail left on a computer. There are various methods to find data that is seemingly deleted, not stored, or worse, covertly recorded. In a CTF context, “Forensic” challenges can include file format analysis, steganography, memory dump analysis, or network packet capture analysis.</p>
<p>For solving forensics CTF challenges, the three most useful abilities are probably:</p>
<ul>
<li>Knowing a scripting language (e.g., Python).</li>
<li>Knowing how to manipulate binary data (byte-level manipulations) in that language.</li>
<li>Recognizing formats, protocols, structures, and encodings.</li>
</ul>
<h3>CTF Challenges</h3>
<p>CTF (Capture The Flag) forensics challenges are a type of cybersecurity competition where participants are tasked with analyzing digital evidence, conducting forensic investigations, and solving puzzles to uncover hidden information or solve specific objectives. Here are some common types of CTF forensics challenges:</p>
<ol>
<li>
<strong>File Analysis:</strong> Participants may be given files such as disk images, memory dumps, network captures, or log files to analyze.</li>
<li>
<strong>Steganography:</strong> Steganography involves hiding messages or data within other files or media to conceal their existence.</li>
<li>
<strong>Network Forensics:</strong> Participants may be provided with network traffic captures or packet captures obtained from a compromised system or network.</li>
<li>
<strong>Memory Forensics:</strong> Memory forensics involves analyzing the volatile memory (RAM) of a system to extract information such as running processes, open network connections, and artifacts left behind by malware.</li>
<li>
<strong>Log Analysis:</strong> Log files from various sources such as web servers, firewalls, and intrusion detection systems (IDS) may be provided to participants.</li>
</ol>
<h3>Common forensics concepts</h3>
<p>Below follows a high-level overview of some of the common concepts in forensics CTF challenges, and some recommended commands for performing common tasks.</p>
<h4>~Initial Analysis</h4>
<p>Forensic CTF challenges often require the use of exploratory steps to determine what to do next. Check below:</p>
<ul>
<li>strings: search for plaintext strings in a file.</li>
<li>grep: search for a particular string in a file.</li>
<li>bgrep: search for non-text data patterns.</li>
<li>hexdump: displays the content of a file in hexadecimal.</li>
</ul>
<h4>~Encodings</h4>
<p>The Binary is 1’s and 0’s, but often is transmitted as text. It would be wasteful to transmit actual sequences of 101010101, so the data is first encoded using one of a variety of methods.</p>
<p>The ability to recognize encodings is beneficial to the solving of forensic CTF challenges. Certain encodings, such as Base64 encoded content, are easily identifiable by their alphanumeric charset and its “=” padding suffix (when present). See example below:</p>
<pre>$ echo aGVsbG8gd29ybGQh | base64 -D<br>hello world!</pre>
<h4>~File Formats</h4>
<p>Common file formats one can encounter during forensics CTF challenges are:</p>
<ul>
<li>Archive files (ZIP, TGZ)</li>
<li>Image file formats (JPG, GIF, BMP, PNG)</li>
<li>Packet captures (PCAP, PCAPNG)</li>
<li>Video (especially MP4) or Audio (especially WAV, MP3)</li>
<li>Microsoft’s Office formats (RTF, OLE, OOXML)</li>
</ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1023/0*0NBKkmGAxHqPu7q-"></figure><h4>~File Signatures</h4>
<p>File Extensions are not the sole way to identify the type of a file, files have certain leading bytes called <em>file signatures</em> which allow programs to parse the data consistently. File signatures (also known as File Magic Numbers) are bytes within a file used to identify the format of the file. Generally, they’re 2–4 bytes long, found at the beginning of a file. Files can sometimes come without an extension, or with incorrect ones. We use file signature analysis to identify the format (file type) of the file.</p>
<p>A Hex Editor is recommended to view file signatures. Once you find the file signature, you can check it against file signature repositories such as <a href="https://www.garykessler.net/library/file_sigs.html">Gary Kessler’s</a>.</p>
<h4>~Image File Analysis</h4>
<p>An image file’s metadata can be viewed using E<a href="https://exiftool.org/">xiftool</a>. The tool displays metadata for an input file, including file size, dimensions (width and height), file type, as well as the program used to create (e.g., Photoshop). Run the following command:</p>
<pre>exiftool(-k).exe [filename]</pre>
<h4><strong>~Timestamps</strong></h4>
<p>Timestamps are data that indicate the time of certain events (MAC):</p>
<ul>
<li>Modification: when a file is modified.</li>
<li>Access: when a file was read or accessed</li>
<li>Creation: when a file was created.</li>
</ul>
<p>Certain events such as creating, moving, copying, opening, editing, etc. might affect the MAC times. If the MAC timestamps can be attained, a timeline of events could be created.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*art-OGlA4eQvkqLQ"></figure><h4>~Steganography</h4>
<p>Steganography is the art of hiding data in images or audio. While extraordinarily rare in the real world, steganography is often a popular CTF challenge. Steganography could be implemented using any kind of data as the “cover text” but media file formats are ideal because they tolerate a certain amount of unnoticeable data loss. One example is the Least Significant Bit (LSB) Steganography, where data is recorded in the lowest bit of a byte.</p>
<p>Files are made of bytes. Each byte is composed of eight bits. As shown in the images below, changing the least significant bit doesn’t affect the value very much.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/809/0*rhlLv10p3Ctvv99q"></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/810/0*4b6s76_PUYDrSJBt"></figure><p>The difficulty with steganography is that extracting the hidden message requires not only a detection that steganography has been used, but also the exact steganographic tool used to embed it. A bit of trial and error might be required.</p>
<p>Recommended tools to tackle steganography include:</p>
<ul>
<li>
<a href="https://github.com/zardus/ctf-tools/blob/master/stegsolve/install">Stegsolve</a>: used to apply various steganography techniques to image files in an attempt to detect and extract hidden data.</li>
<li>
<a href="http://steghide.sourceforge.net/">Steghide</a>: hidea data in various kinds of image- and audio files.</li>
<li>
<a href="https://github.com/zed-0xff/zsteg">zsteg</a>: detect hidden data in PNG and GMP files.</li>
<li>
<a href="https://www.openstego.com/">OpenStego</a>: free steganography solution.</li>
<li>
<a href="https://www.kali.org/tools/foremost/">Foremost</a>: a forensic program to recover lost files based on their headers, footers, and internal data structures.</li>
<li>
<a href="https://stegonline.georgeom.net/upload">StegOnline</a>: online steganography tool.</li>
</ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/820/0*MAYz-O1caiA0CNkr"></figure><h4>~Filesystem Analysis</h4>
<p>Occasionally, a forensic CTF challenge will involve a full disk image. A disk image is a computer file containing the contents and structure of a disk volume or of an entire data storage device, such as a hard disk drive. The first logical step will be to mount the disk image file. Below is an example of mounting a CD-ROM filesystem image:</p>
<pre>mkdir /mnt/challenge<br><br>mount -t iso9660 challengefile /mnt/challenge</pre>
<p>Searching for a flag in a mounted disk image is similar to finding a needle in this haystack — a strategy will be required. Once the filesystem is mounted, the tree command can be used to view the directory structure and see if anything sticks out requiring further analysis. Therefore, a bit of understanding and insight into well-known filesystems will be beneficial:</p>
<ul>
<li>New Technology File System (NTFS): a modern, well-formed filesystem that is most commonly used by Windows.</li>
<li>File Allocation Table (FAT): a general purpose file system that is compatible with all major operating systems.</li>
<li>Extended (EXT) filesystem: created to be used with the Linux kernel (EXT4 is the most recent version).</li>
<li>Hierarchical File System (HFS) Plus: a file system developed by Apple for Mac OS X.</li>
</ul>
<p>In certain cases, one might not be looking for a visible file within the filesystem, but rather a hidden volume, unallocated space (disk space that is not a part of any partition), a deleted file, or a non-file filesystem structure. For the recovery of deleted or missing files, the following tools are commended:</p>
<ul>
<li>
<a href="http://extundelete.sourceforge.net/">extundelete</a>: find deleted files in EXT3 and EXT4 filesystems.</li>
<li>
<a href="https://www.cgsecurity.org/wiki/TestDisk">TestDisk</a>: recover missing partition tables, fix corrupted ones, undelete files on FAT or NTFS, etc.</li>
</ul>
<p><a href="https://www.sleuthkit.org/autopsy/">Autopsy</a> is a powerful open-source toolkit for filesystem analysis. Although more geared toward law-enforcement tasks, available features can be helpful for tasks like searching for a keyword across the entire disk image, or looking at the unallocated space.</p>
<h4>~Network Traffic Analysis</h4>
<p>Network traffic is stored and captured as a Packet capture (PCAP) file using programs like <a href="https://www.tcpdump.org/">tcpdump</a> or <a href="https://www.wireshark.org/">Wireshark</a> . A popular forensic CTF challenge is to provide a PCAP file representing some network traffic and challenge the player to recover/reconstitute a transferred file or transmitted secret. Complicating matters, the packets of interest are usually in an ocean of unrelated traffic, so analysis triage and filtering of the data are also required.</p>
<p>For initial analysis, take a high-level view of the packets using Wireshark’s statistics or conversations view, or applying the</p>
<p><a href="https://www.wireshark.org/docs/man-pages/capinfos.html">capinfos</a></p>
<p>command. Wireshark, and its command-line version</p>
<p><a href="https://www.wireshark.org/docs/man-pages/tshark.html">tshark</a></p>
<p>both support the concept of using filters that can reduce the scope of the analysis. Alternatively, PCAP files up to 50MB can be submitted to an online service called</p>
<p><a href="https://packettotal.com/">PacketTotal</a></p>
<p>which can graphically display timelines of connections and SSL metadata on the secure connections.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*_FNodDkr31jCaUpZ"></figure><h3>Approach or Solving technique</h3>
<h4>~Wrong Spooky Season</h4>
<ul><li>
<em>“I told them it was too soon and in the wrong season to deploy such a website, but they assured me that theming it properly would be enough to stop the ghosts from haunting us. I was wrong.” Now there is an internal breach in the </em><em>Spooky Network and you need to find out what happened. Analyze the the network traffic and find how the scary ghosts got in and what they did.</em>
</li></ul>
<h4>Solution:</h4>
<p>Downloading the challenge files, we get a PCAP file. Opening it in wireshark, we see the HTTP requests. Looking into them we can see the command injection.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/875/0*glDR8tNH32G-RVdp"></figure><p>Analyzing the http stream, we get the commands sent and one command has a base64 encoded string.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/875/0*Nk_newG7yVO_wYCg"></figure><p>Decoding and reversing the string we get the flag.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/735/0*cncO1JrLXLh1e34G"></figure><h3>PurpleThing</h3>
<h4>Step-1:</h4>
<p>After downloading PurpleThing.jpeg from the cloud, I tried strings PurpleThing.jpeg | grep {.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/780/0*SI1G_eomLPbZijmo"></figure><h4>Step-2:</h4>
<p>So I tried <strong>binwalk PurpleThing.jpeg</strong> as the question suggests.</p>
<p>It showed me the following output:</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/563/1*LGdq01SX2M-t_-YcWyIk7A.png"></figure><p>Clearly, there is hidden data in there, let’s extract that.</p>
<h4>Step-3:</h4>
<p>I input a command of <strong>binwalk -D 'image:png' PurpleThing.jpeg</strong> and I get a directory named <strong>_PurpleThing.jpeg.extracted</strong>.</p>
<p>The contents are different files. In it '25795.png’ has the flag.</p>
<h4>Step-4:</h4>
<p>Finally the flag becomes:</p>
<p><strong>HTF{b1nw4lk_is_us3ful}</strong></p>
<p>and many more… You can always google for more 🛡️👨‍💻</p>
<h3>Contribution</h3>
<p><a href="https://medium.com/@ddugs">Dhruv Gupta</a></p>
<p><a href="https://medium.com/@cjobsidian6">Adithya Sriram</a></p>
<p><a href="https://medium.com/@devansh6061">Devansh Gupta</a></p>
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=69dfa8cd25f4" width="1" height="1" alt=""><hr>
<p><a href="https://infosecwriteups.com/investigating-the-files-with-forensics-ctf-newbies-69dfa8cd25f4">Investigating The Files With Forensics | CTF Newbies</a> was originally published in <a href="https://infosecwriteups.com/">InfoSec Write-ups</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.</p>


Investigating The Files With Forensics | CTF Newbies


<figure><img alt="" src="https://cdn-images-1.medium.com/max/1000/0*VSgsjFNg7BR5cUTE"></figure><p>In the realm of cybersecurity, cryptography stands as the fortress guarding the secrets of digital communication. As technology advances and our world becomes increasingly interconnected, the need to protect sensitive information has never been more critical. Cryptography serves as the cornerstone of this defense, employing mathematical algorithms and encryption techniques to secure data transmission and storage.</p>
<ol>
<li>
<strong>Encryption:</strong> Cryptography uses encryption techniques to convert plaintext data into ciphertext, rendering it unreadable to unauthorized users.</li>
<li>
<strong>Confidentiality:</strong> It ensures that only authorized parties can access and decipher encrypted data, maintaining confidentiality in digital communications and transactions.</li>
<li>
<strong>Integrity:</strong> Cryptography verifies the integrity of data by detecting any unauthorized alterations or tampering attempts during transmission or storage.</li>
<li>
<strong>Authentication:</strong> It provides methods for verifying the identity of parties involved in communication, ensuring that they are who they claim to be.</li>
<li>
<strong>Digital Signatures:</strong> Cryptography facilitates the creation and verification of digital signatures, which ensure the authenticity and integrity of digital documents or messages.</li>
<li>
<strong>Secure Communication:</strong> It forms the foundation of secure communication protocols such as SSL/TLS, SSH, and VPNs, protecting data transmitted over networks from eavesdropping and interception.</li>
</ol>
<h3>PREREQUISITES:</h3>
<p>To effectively solve cryptography-based challenges in Capture The Flag (CTF) competitions, you’ll need a combination of knowledge and skills in various areas. Here’s a list of prerequisites:</p>
<ol>
<li>
<strong>Basic Cryptography Concepts</strong>: Understanding fundamental cryptographic concepts such as encryption, decryption, hashing, symmetric and asymmetric encryption, key exchange protocols, digital signatures, etc., is essential.</li>
<li>
<strong>Mathematics</strong>: A basic understanding of mathematics, including modular arithmetic, number theory, probability theory, and algebra, is crucial for understanding many cryptographic algorithms.</li>
<li>
<strong>Programming Skills</strong>: Proficiency in at least one programming language (preferably Python, C, or C++) is necessary for implementing and analyzing cryptographic algorithms, as well as for scripting solutions to automate certain tasks.</li>
<li>
<strong>Knowledge of Cryptographic Algorithms</strong>: Familiarity with common cryptographic algorithms like AES, RSA, Diffie-Hellman, ECC (Elliptic Curve Cryptography), SHA, MD5, etc., is important. You should know how these algorithms work, their strengths, weaknesses, and common attack vectors.</li>
<li>
<strong>Understanding of Cryptanalysis Techniques</strong>: Knowledge of various cryptanalysis techniques such as frequency analysis, brute-force attacks, chosen-plaintext attacks, known-plaintext attacks, etc., is necessary to break cryptographic systems.</li>
<li>
<strong>Understanding of Encoding and Hashing</strong>: Familiarity with different encoding schemes like Base64, Base32, hexadecimal, etc., as well as hashing algorithms like MD5, SHA-1, SHA-256, etc., is important since these are frequently used in CTF challenges.</li>
<li>
<strong>Experience with Cryptographic Tools</strong>: Familiarity with cryptographic tools and libraries such as OpenSSL, Cryptool, CrypTool 2, PyCrypto, Cryptography library in Python, etc., can be beneficial for analyzing and implementing cryptographic solutions.</li>
<li>
<strong>Continuous Learning</strong>: Cryptography is a rapidly evolving field, so being open to learning new concepts, staying updated with the latest developments, and practicing regularly are crucial for success in CTF competitions.</li>
</ol>
<h4><strong>RSA —</strong></h4>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/730/1*YeMrSVIclqhAFXWw4I5q9g.png"></figure><p>RSA (Rivest-Shamir-Adleman) is a widely used encryption algorithm for secure data transmission. Rotating RSA could involve key rotation practices.</p>
<p>Key rotation is a security best practice that involves regularly replacing cryptographic keys with new ones. it will only expose a limited amount of data.</p>
<p>In the context of RSA, rotating keys could involve generating new key pairs periodically and replacing the old ones.</p>
<h4><strong>AES —</strong></h4>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/960/0*9GT-O3JVMCSB0HYf"></figure><p>The Advanced Encryption Standard (AES) is a widely used symmetric encryption algorithm. It operates on fixed-size blocks of data (128 bits in AES), employing keys of varying lengths (128, 192, or 256 bits). AES replaces the older Data Encryption Standard (DES) and provides stronger security.</p>
<p>AES serves as a critical tool in ensuring data security and confidentiality across various applications and industries.</p>
<h4><strong>Hashing —</strong></h4>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*MJizH030NggWFv4yLJ5Usg.png"></figure><p>In cybersecurity, hashing is a process that converts plaintext passwords or any data into a fixed-length string of characters using a cryptographic hashing algorithm. Common hashing algorithms include MD5, SHA-1, SHA-256, and bcrypt.</p>
<h4>Hash Cracking Techniques:-</h4>
<ul>
<li>Password Hashing: Websites and applications often store user passwords in hashed form rather than plaintext to enhance security.</li>
<li>Brute Force Attack: This involves trying every possible combination until the correct one is found. While it’s not efficient for longer passwords or complex hash functions, it’s a fundamental technique.</li>
<li>Dictionary Attack: Uses a predefined list of common passwords or dictionary words to attempt to crack hashes. It’s faster than brute force and targets common passwords first.</li>
<li>Rainbow Table Attack: Precomputed tables containing hash values for a large number of possible plaintext passwords.</li>
<li>Hybrid Attack: Combines elements of brute force, dictionary, and rule-based attacks to optimize the cracking process.</li>
<li>Tools: There are various tools available for hash cracking, such as Hashcat, John the Ripper, and Cain &amp; Abel.</li>
</ul>
<h3>CRYPTOGRAPHY TOOLS FOR CTF:</h3>
<h4><strong>1. OpenSSL:</strong></h4>
<ul>
<li>Description: OpenSSL is a robust, open-source implementation of the SSL and TLS protocols, along with a full-strength cryptography library.</li>
<li>Features: It provides various cryptographic functions, including symmetric encryption (e.g., AES), asymmetric encryption (e.g., RSA), hashing algorithms (e.g., MD5, SHA), digital signatures, key generation, SSL/TLS protocols, and more.</li>
<li>Usage: OpenSSL is often used for secure communication, cryptographic operations, certificate management, and cryptographic analysis.</li>
<li>Here are some common commands and functionalities that might be used in CTF challenges involving OpenSSL:</li>
<li>Generating RSA Keys:</li>
</ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/475/0*4qgTWB4S7rG0N6Lo"></figure><ul><li>Extracting Public Key from Private Key:</li></ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/566/0*MJ5FWO9sSPz4OisC"></figure><ul><li>Encrypting/Decrypting Base64:</li></ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/617/0*kPK_5WeHlsVOPWsk"></figure><ul><li>Creating and Verifying Message Authentication Codes(MAC):</li></ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/887/0*LbX__E5Zq57iHiXV"></figure><h4><strong>2. Cryptool:</strong></h4>
<ul>
<li>Description: Cryptool is an open-source cryptography and cryptanalysis software that provides a graphical user interface (GUI) for analyzing and understanding cryptographic algorithms.</li>
<li>Features: It offers tools for experimenting with cryptographic algorithms, visualizing encryption/decryption processes, analyzing ciphers, performing cryptanalysis, and educational purposes.</li>
<li>Usage: Cryptool is widely used in educational settings, cryptographic research, and by security professionals for understanding and analyzing cryptographic algorithms.</li>
</ul>
<h4><strong>3. CrypTool 2:</strong></h4>
<ul>
<li>Description: CrypTool 2 is an open-source cryptography and cryptanalysis software, which is an improved and extended version of Cryptool.</li>
<li>Features: Similar to Cryptool, CrypTool 2 provides a GUI for experimenting with cryptographic algorithms, analyzing ciphers, performing cryptanalysis, and educational purposes. It includes additional features and improvements over Cryptool.</li>
<li>Usage: CrypTool 2 is used for educational purposes, cryptographic research, and by security professionals for understanding and analyzing cryptographic algorithms.</li>
</ul>
<h4><strong>4. PyCrypto:</strong></h4>
<ul>
<li>Description: PyCrypto is a collection of cryptographic algorithms and protocols implemented in Python.</li>
<li>Features: It provides various cryptographic functions, including symmetric encryption (e.g., AES), asymmetric encryption (e.g., RSA), hashing algorithms (e.g., MD5, SHA), digital signatures, and more, all implemented in Python.</li>
<li>Usage: PyCrypto is often used for implementing cryptographic solutions, writing cryptographic scripts, performing cryptographic operations in Python-based applications, and cryptographic experimentation.</li>
<li>Here are some common commands and functionalities that might be used in PyCrypto during CTF challenges:</li>
<li>Symmetric Encryption/Decryption:</li>
</ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/782/0*4axMdwMNys64dUu8"></figure><ul><li>Asymmetric Encryption/Decryption:</li></ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/517/0*ah60HqKqzBHoMS14"></figure><ul><li>Hash Functions:</li></ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/408/0*uOKR4xImR2G9UiLl"></figure><p>These tools offer a wide range of capabilities for cryptographic analysis, experimentation, implementation, and education, catering to different user needs and preferences.</p>
<h4>5. Dcode —</h4>
<p>It is an online tool that can be used to identify/recognize the type of encryption/encoding applied to a message (more 200 ciphers/codes are detectable). Cipher identifier to quickly decrypt/decode any text.</p>
<p><a href="https://www.dcode.fr/cipher-identifier">https://www.dcode.fr/cipher-identifier</a></p>
<h4>6. CyberChef —</h4>
<p>CyberChef is a simple, intuitive web app for carrying out all manner of “cyber” operations within a web browser. These operations include simple encoding like XOR or Base64, more complex encryption like AES, DES and Blowfish, creating binary and hexdumps, compression and decompression of data, calculating hashes and checksums, IPv6 and X.509 parsing, changing character encodings, and much more.</p>
<p><a href="https://gchq.github.io/CyberChef/">CyberChef</a></p>
<h3>Practical, real-life usage:</h3>
<p>How to Encrypt / Decrypt files using OpenSSL</p>
<pre>openssl aes-256-cbc -base64 -salt -pbkdf2 -in secrets.txt -out secrets.txt.enc</pre>
<ul><li>
<strong>aes-256-cbc</strong>:</li></ul>
<p>CBC standard for Cipher Block Chaining</p>
<p>256 States the bit key length</p>
<p>AES stands for Advanced encryption standard</p>
<ul><li>
<strong>-base64</strong>:</li></ul>
<p>This flag commands openssl to output data in base64 encryption</p>
<ul><li>
<strong>-salt</strong>:</li></ul>
<p>This option instructs OpenSSL to use a salt when generating the encryption key.</p>
<ul><li><strong>-pbkdf2:</strong></li></ul>
<p>This option specifies the use of the PBKDF2 (Password-Based Key Derivation Function 2) algorithm for key derivation</p>
<ul><li>
<strong>-in secrets.txt</strong>:</li></ul>
<p>This specifies the input file to be encrypted, in this case, secrets.txt.</p>
<ul><li>
<strong>-out secret.txt.enc</strong>:</li></ul>
<p>This specifies the output file where the encrypted data will be written, in this case, secret**.txt.enc**</p>
<pre>openssl aes-256-cbc -d -base64 -pbkdf2 -in secret.txt.enc -out secrets.txt.new</pre>
<ul><li>
<strong>aes-256-cbc</strong>:</li></ul>
<p>CBC standard for Cipher Block Chaining</p>
<p>256 States the bit key length</p>
<p>AES stands for Advanced encryption standard</p>
<p>-d: This option indicates that OpenSSL should decrypt the input data</p>
<ul><li>
<strong>-base64</strong>:</li></ul>
<p>This flag commands openssl to output data in base64 encryption</p>
<ul><li><strong>-pbkdf2:</strong></li></ul>
<p>This option specifies the use of the PBKDF2 (Password-Based Key Derivation Function 2) algorithm for key derivation</p>
<ul><li>
<strong>-out secret.txt.new</strong>:</li></ul>
<p>This specifies the output file where the decrypted data will be written, in this case, secret**.txt.new**</p>
<ul><li>
<strong>-in secrets.txt.enc</strong>:</li></ul>
<p>This specifies the input file to be decrypted, in this case, secrets.txt.enc</p>
<h3>Solving a Crypto category CTF problem —</h3>
<p>Question Description:</p>
<p><em>In the realm of communication, RSA is one of the techniques (in cryptography) to secure communication via the Internet. so to solve the given Cipher text “C” which is in RSA I have provided you with the two keys one is the private key and another is the public key. in RSA you can encrypt a message using any of the keys but to decrypt you need to use the other one(the one that is not used for the encryption).</em></p>
<p><em>THE TEXT FILE CONTAINS THE CIPHER TEXT(FLAG) WITH RSA MATHEMATICS</em></p>
<p><em>flag_format = HTBSRMIST{flag_here}.</em></p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/954/1*EeSzSOTaz04joGgUdrj45Q.png"></figure><h3>Given instructions in the text file :-</h3>
<p>step 1: assume two prime numbers P and Q .</p>
<p>step 2: calculate N which is P X Q (multiplication of P and Q).</p>
<p>step 3: calculate ƛ(n) which LCM(P-1, Q-1) .</p>
<p>step 4: choose any random value between 2 to ƛ(n) which is e. e also should be coprime with ƛ(n).</p>
<p>step 5: now let’s calculate d which is the modular multiplicative inverse of e modulo ƛ(n) or d = (e)^-1(modƛ(n)).</p>
<p>public key is the pair of (N,e)</p>
<p>private key is the pair of(N,d)</p>
<p>Cipher text = message^e(mod n)</p>
<p>Message text = cipher^d(mod n)</p>
<p>we start writing a Python script to solve this.</p>
<pre>public_key = (3233, 2753)</pre>
<p>we define a <em>public_key</em> tuple where 3233 is the large integer used in RSA encryption (<strong>N</strong>)</p>
<pre>message = [3000, 2159, 524, 2680, 1859, 3123, 1486, 2680, 2159, 855, 99, 624, 2160, 119, 641, 2412, 529, 281, 597, 368, 1759, 119, 2653, 2170, 368, 119, 1859, 1802, 529, 1516]</pre>
<p>with this line, we initialize a list having ASCII values of characters of the message</p>
<pre>N, e = public_key</pre>
<p>We now unpack the <em>public_key</em> tuple into two variables <strong>N</strong> and <strong>e,</strong></p>
<p>now N = 3233 ; e= 2753</p>
<pre>cipher_text = [(m ** e) % N for m in message]</pre>
<p>we now iterate over each integer m in the message list, which then computes its encryption using the RSA algorithm.</p>
<pre>ascii_text = ''.join(chr(c) for c in cipher_text)</pre>
<p>Here we convert the list of integers into a string by iterating over each integer <strong>c</strong> in <em>cipher_text</em> and converts to a character using <em>the chr()</em> function.</p>
<pre>print(ascii_text)</pre>
<p>finally, we print the string.</p>
<p>The complete code is as follows:</p>
<pre>public_key = (3233, 2753)<br>message = [3000, 2159, 524, 2680, 1859, 3123, 1486, 2680, 2159, 855, 99, 624, 2160, 119, 641, 2412, 529, 281, 597, 368, 1759, 119, 2653, 2170, 368, 119, 1859, 1802, 529, 1516]<br>N, e = public_key<br>cipher_text = [(m ** e) % N for m in message]<br>ascii_text = ''.join(chr(c) for c in cipher_text)<br>print(ascii_text)</pre>
<p>Output:</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*LCxzPh18u--U-RoUIQXsgg.png"></figure><pre>FLAG : HTBSRMIST{Y0u_Cr4cK3D_7h3_R54}</pre>
<h4>Contribution —</h4>
<p><a href="http://medium.com/@jsuyash">Suyash Jain</a></p>
<p>Bhavya Agarwal</p>
<p><a href="https://medium.com/@nishchaymanhas">Nishchay Manhas</a></p>
<p><a href="https://medium.com/@devansh6061">Devansh Gupta</a></p>
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=bbe042dc97e4" width="1" height="1" alt=""><hr>
<p><a href="https://infosecwriteups.com/unlocking-with-cryptography-ctf-newbies-bbe042dc97e4">Unlocking with Cryptography | CTF Newbies</a> was originally published in <a href="https://infosecwriteups.com/">InfoSec Write-ups</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.</p>


Unlocking with Cryptography | CTF Newbies


<figure><img alt="" src="https://cdn-images-1.medium.com/max/800/0*2QbS4ixC-NGtvkqs.jpg"></figure><h3>Introduction</h3>
<p>In the intricate world of cybersecurity, understanding vulnerabilities and exploiting them is both an art and a science. From the humble beginnings of early hackers tinkering with systems to today’s sophisticated penetration testing, the exploration of vulnerabilities remains a critical aspect of securing digital infrastructures. This introduction serves as a gateway into this realm, shedding light on the fundamentals of exploiting vulnerable machines.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/851/0*axhQjpRt8Ik73jF6.png"></figure><h3>Prerequisites</h3>
<ol>
<li>
<strong>Basic Computer Skills</strong>: A fundamental understanding of operating systems (e.g., Windows, Linux) and basic command-line usage is essential. This includes familiarity with file systems, processes, and basic system administration tasks.</li>
<li>
<strong>Networking Concepts</strong>: Knowledge of networking fundamentals such as TCP/IP, DNS, HTTP, and network protocols is crucial. Understanding how data moves across networks and between systems is essential for exploiting vulnerabilities effectively.</li>
<li>
<strong>Programming Fundamentals</strong>: Proficiency in at least one programming language (e.g., Assembly, Python, C, or Bash scripting) is highly recommended. You should understand variables, data types, loops, conditional statements, and basic algorithms. Additionally, familiarity with debugging techniques is beneficial.</li>
<li>
<strong>Web Technologies</strong>: Basic knowledge of web technologies such as HTML, CSS, JavaScript, and HTTP protocols is advantageous, especially if you intend to explore web application vulnerabilities like SQL injection, XSS (Cross-Site Scripting), and CSRF (Cross-Site Request Forgery).</li>
<li>
<strong>Virtualization</strong>: Experience with virtualization platforms like VirtualBox or VMware is recommended. Virtual machines (VMs) provide a safe environment for practicing exploitation techniques without risking damage to real-world systems.</li>
<li>
<strong>Security Tools</strong>: Familiarity with common security tools such as Wireshark (for network analysis), Nmap (for network scanning), Metasploit (for exploitation), and Burp Suite (for web application testing) is beneficial. Understanding how to use these tools effectively enhances your ability to identify and exploit vulnerabilities.</li>
</ol>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/592/0*jZyflOyj0VIsoGN7.png"></figure><h3>Binary Exploitation</h3>
<p>Binaries, or executables, are machine code for a computer to execute. For the most part, the binaries that you will face in CTFs are Linux ELF files or the occasional windows executable.</p>
<p>We can solve these type of challenges by identifying these vulnerabilities in the file :-</p>
<h4>1. Buffer Overflow —</h4>
<p>A Buffer Overflow is a vulnerability in which data can be written which exceeds the allocated space, allowing an attacker to overwrite other data.</p>
<p>The simplest and most common buffer overflow is one where the buffer is on the stack.</p>
<pre>#include &lt;stdio.h&gt;<br>#include &lt;string.h&gt;<br><br>void vulnerable_function(char *input) {<br>    char buffer[10];<br>    strcpy(buffer, input);<br>    printf("Buffer content: %s\n", buffer);<br>}<br><br>int main() {<br>    char input[20];<br>    printf("Enter a string: ");<br>    scanf("%s", input);<br>    vulnerable_function(input);<br>    return 0;<br>}</pre>
<p>In this example, vulnerable_function is the vulnerable function. It takes a string input as a parameter and copies it into a fixed-size buffer buffer using the strcpy function. The buffer size is 10 bytes, but there is no check on the length of the input string. If the input string is longer than 10 characters, a buffer overflow will occur, overwriting adjacent memory locations on the stack.</p>
<p>Run this program, and provide an input string longer than 10 characters.</p>
<pre>$ ./buffer_overflow<br>Enter a string: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</pre>
<p>This will likely cause a segmentation fault or undefined behavior, as the program tries to write beyond the bounds of the buffer array.</p>
<p>We can use a debugger to see the offsets and the assembly of the program. As you will get this program in a.out only so you can debug and decompile this and can understand the assembly of the program.</p>
<h4>2. Heap Exploits —</h4>
<p>Much like stack buffer overflow, a heap overflow is a vulnerability where more data than can fit in the allocate buffer is read in.</p>
<p>Example —</p>
<pre>#include &lt;stdio.h&gt;<br>#include &lt;stdlib.h&gt;<br>#include &lt;unistd.h&gt;<br>#include &lt;string.h&gt;<br><br>typedef struct string {<br>    unsigned length;<br>    char *data;<br>} string;<br><br>int main() {<br>    struct string* s = malloc(sizeof(string));<br>    puts("Length:");<br>    scanf("%u", &amp;s-&gt;length);<br>    s-&gt;data = malloc(s-&gt;length + 1);<br>    memset(s-&gt;data, 0, s-&gt;length + 1);<br>    puts("Data:");<br>    read(0, s-&gt;data, s-&gt;length);<br><br>    free(s-&gt;data);<br>    free(s);<br><br>    char *s2 = malloc(16);<br>    memset(s2, 0, 16);<br>    puts("More data:");<br>    read(0, s2, 15);<br><br>    // Now using s again, a UAF<br><br>    puts(s-&gt;data);<br><br>    return 0;<br>}</pre>
<p>in this we have a string structure with a length and a pointer to the actual string data. We properly allocate, fill, and then free an instance of this structure. Then we make another allocation,fill it , and then improperly reference the freed <strong>string</strong>. Due to how glibc’s allocator works, s2 will actually get the same memory as the original <strong>s</strong> allocation, which in turn gives us the ability to control the <strong>s-&gt;data </strong>pointer. This could be used to leak program data.</p>
<h3>Useful Tools</h3>
<ol>
<li>
<strong>PWNTools:</strong> This is a Python library that provides a set of utilities and APIs for crafting exploits, interacting with binary programs, and automating various tasks involved in exploitation.</li>
<li>
<strong>ROPgadget</strong>: Return-oriented programming (ROP) is a technique used in exploitation to bypass certain security mechanisms like DEP (Data Execution Prevention). ROPgadget is a tool used for finding gadgets (small snippets of code ending in a return instruction) in binaries that can be chained together to form an exploit payload.</li>
<li>
<strong>anger:</strong> This is an open-source binary analysis It combines both static and dynamic symbolic (“consoles”) analysis, providing tools to solve a variety of tasks.</li>
<li>
<strong>Immunity Debugger:</strong> This is a powerful new way to write exploits, analyze malware, and reverse engineer binary files. It builds on a solid user interface with function graphing, the industry’s first heap analysis tool built specifically for heap creation, and a large and well-supported Python API for easy extensibility.</li>
<li>
<strong>peda (Python Exploit Development Assistance)</strong>: peda is a Python plugin for GDB (GNU Debugger) that provides additional commands and features to assist with exploit development. It simplifies tasks such as searching for gadgets, analyzing memory, and crafting payloads.</li>
<li>
<strong>BinDiff</strong>: BinDiff is a commercial tool for binary diffing, which compares two binary executables to identify similarities and differences. It’s commonly used for vulnerability analysis, patch diffing, and reverse engineering.</li>
<li>
<strong>Frida</strong>: Frida is a dynamic instrumentation toolkit that allows for runtime manipulation and analysis of binary executables across various platforms. It can be used for dynamic binary instrumentation, hooking functions, and exploring program behavior during runtime.</li>
</ol>
<h3>PWN Example</h3>
<p>Over here we will be taking a basic example for the PWN Challenge. The example we will be taking is the Stonks question from the picoctf.</p>
<p>Question:</p>
<p>I decided to try something no one else had before. I made a bot to automatically trade stocks for me using AI and machine learning. I wouldn’t believe you if you told me it’s unsecure!</p>
<p><a href="https://mercury.picoctf.net/static/e4d297ce964e4f54225786fe7b153b4b/vuln.c">vuln.c</a></p>
<pre>nc mercury.picoctf.net 20195</pre>
<p>Now we see a netcat command over here and we run it to see the following</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/541/1*LWmvDRJRkijOP01wYShqnQ.png"></figure><p>Now if we have a look at the vuln.c file we see that it scans the API key using a string so using %x it can generate something of interest.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/705/1*sU4RYwQVuTVlu1sIenpqQw.png"></figure><p>So we select option 1 and we see that it asks for the API Key so we bombard the input with many %x’s.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*fWxfbYCyMWLIsphNmTkeDQ.png"></figure><p>Now we add this hexadecimal string to decode to find the flag: picoCTF{l_I4_t5m_ll0m_y_y3n5406d06d}</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*3RAyg9sSR4rCDLaZ0Hu5iw.png"></figure><p>NOTE: You have to remove some elements to get the perfect flag.</p>
<h3>Tools Used In Example</h3>
<p>Cyberchef- To decode Hex to String</p>
<p>Any Code Editor- To have a look at the code</p>
<h3>Resources</h3>
<ul>
<li><a href="https://ctf101.org/binary-exploitation/overview/">Overview - CTF Handbook</a></li>
<li><a href="https://wiki.osucyber.club/Bootcamp-CTF/Challenge-Types/Pwn">Intro to Pwn</a></li>
<li><a href="https://febinj.medium.com/decode-e-cyber-ctf-2023-pwn-binary-exploitation-writeup-1-3e4c93a01dd1">Decode-E-Cyber CTF 2023 — PWN/Binary Exploitation Writeup — 1</a></li>
</ul>
<h3>Conclusion</h3>
<p>In the above article, we have seen how a PWN challenge works and how can we approach a challenge in the PWN or Binary Exploitation. Hope you have understood and will feel at ease in solving the questions.</p>
<h3>Contribution</h3>
<p><a href="https://medium.com/@devansh6061">Devansh Gupta</a></p>
<p><a href="https://medium.com/@dhruvpridhnani">Dhruv Pridhnani</a></p>
<p>Abihimanyu V</p>
<h3>Happy Hacking!!</h3>
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=99d68c919269" width="1" height="1" alt=""><hr>
<p><a href="https://infosecwriteups.com/binary-brilliance-unleashing-pwn-ctf-newbies-99d68c919269">Binary Brilliance: Unleashing Pwn | CTF Newbies</a> was originally published in <a href="https://infosecwriteups.com/">InfoSec Write-ups</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.</p>


Binary Brilliance: Unleashing Pwn | CTF Newbies


<h3>Introduction:</h3>
<p>Welcome to the world of open-source intelligence (OSINT)! In this beginner-friendly guide, we’ll explore how OSINT can empower you to gather valuable information from publicly available sources. Let’s dive in!</p>
<h3>What is OSINT?</h3>
<p>OSINT stands for Open Source Intelligence. It involves collecting and analyzing information from publicly accessible sources like websites, social media, and government databases. It’s like being a digital detective, using online tools and techniques to uncover insights.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/356/0*ycf9-2vWioFSOqqZ"></figure><h3>Categories of OSINT:</h3>
<ul>
<li>Publicly Available Documents</li>
<li>Web Data</li>
<li>Network Data</li>
<li>Geospatial Data</li>
<li>Media Data</li>
</ul>
<h3>Common OSINT Tools:</h3>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/364/0*LrygrYoANw8CuxA7"></figure><ul><li>
<strong>Harvester</strong>: This tool is great for searching and collecting emails, subdomains, hosts, and employee names from search engines.</li></ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*xAlsADg-pdzrWSRn"></figure><ul><li>
<strong>Shodan</strong>: Use Shodan as a search engine for Internet-connected devices like IoT devices, webcams, and servers.</li></ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/640/0*vdNR7KXTpcTKcYsL"></figure><ul><li>
<strong>Censys</strong>: Censys is a search engine that lets you search for and analyze Internet-connected devices and networks.</li></ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*EskLJEkn0bBI_EdL"></figure><ul><li>
<strong>Maltego</strong>: Start by creating a new graph and adding entities like email addresses, domain names, or IP addresses. Maltego will then automatically gather and visualize related information, helping you see connections between different data points.</li></ul>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*bqTchkcJ2M2xmrll"></figure><h3>Finding email addresses:</h3>
<p><a href="http://hunter.io/"><strong>Hunter.io</strong></a>:Hunter.io is a powerful email search tool that scours the web to find email addresses associated with a specific domain. It utilizes various sources, including public websites and social media platforms, to compile a list of email addresses related to your search query.</p>
<p><strong>Email Verification Tools</strong>: Once you’ve compiled a list of potential email addresses, it’s essential to verify their validity. Email verification tools like Email Hunter, NeverBounce, and Verifalia help you ensure that the email addresses you’ve found are active and deliverable.</p>
<p><strong>Username and Email Search:</strong></p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*9qCm1XNACNlLnxpF"></figure><p>Users can search for a specific username or email on dating sites. Some platforms allow users to verify usernames by entering them after the site’s URL.</p>
<h3>Image Searching :</h3>
<p>Each search engine has its capabilities Yandex is better than Google in terms of image searching as I have used it and gives better results than Google.Also, TinEye works great for reverse image searching.</p>
<p><strong>Yandex:</strong> <a href="https://yandex.com/">https://yandex.com</a></p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*18MsCS7rcNnUyWM0rzt-OA.png"></figure><p><strong>TinEye:</strong> <a href="https://tineye.com/">https://tineye.com</a></p>
<h3>Reverse Image Search:</h3>
<p>This technique involves using reverse image search tools to find other online profiles associated with a particular image. It helps identify fake or duplicate profiles.</p>
<p><strong>Metadata Extraction</strong>:</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*1jU2Nm2TbG7xPvis"></figure><p>Metadata embedded in photos uploaded to dating sites can contain information such as the time and location the photo was taken. Tools like Exiftool can extract this information.</p>
<p><strong>Profile Analysis</strong>:</p>
<p>Analyzing profiles on dating sites provides insights into a person’s interests, habits, and social circle, aiding in understanding their background and authenticity.</p>
<h3>Google Dorking:</h3>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/512/0*b9A6BtYC_qJ_yEjf"></figure><p>Advanced Google search techniques, known as Google Dorking, help find information not easily accessible through simple searches, potentially revealing hidden profiles or information.</p>
<h3>
<strong>Gathering mobile number information</strong>:</h3>
<h4>
<strong>PhoneInfoga</strong>:</h4>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/297/0*d8FqWb7QenQVXHHH"></figure><p>PhoneInfoga is a command-line tool used to gather information about phone numbers. It can provide details such as the carrier, location, and whether the number is associated with scams.</p>
<h4>
<strong>Scylla</strong>:</h4>
<p>Scylla helps find all social media accounts associated with a particular username, including Instagram, Twitter, websites, phone numbers, and names.</p>
<h3>Web Search:</h3>
<p>Conducting web searches using search engines can reveal information associated with a phone number, including social media profiles and online accounts.</p>
<p><strong>Reverse Phone Lookup Services</strong>:</p>
<p>Online services offer a reverse phone lookup, providing details like the owner’s name, location, and more by entering the phone number.</p>
<h3>Exploring domain names:</h3>
<p><strong>Whois Lookup</strong>: A query revealing domain registration details is useful for identifying domain owners. Tools like <a href="http://whois.net/">Whois.net</a> and DomainTools simplify this process.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/852/0*xIWJAWp72qaBtKmF"></figure><p><strong>DNS Lookup</strong>: Discovers DNS records associated with a domain, including A, MX, and TXT records. Dig, Nslookup, and MxToolbox are handy tools for this task.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/643/0*LIMRV5s7JmHzRGtx"></figure><h3>Navigating Tor:</h3>
<p><strong>Tor Browser</strong>: Facilitating anonymous communication, the Tor Browser routes internet traffic through relay nodes, which is crucial for accessing the dark web.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/752/0*sLf1U4oILlB8XFL4"></figure><p><strong>Onion Sites</strong>: These websites are accessible only through the Tor network, providing access to information not available on the surface web.</p>
<p><strong>Onion Crawling</strong>: indexes and searches onion sites, revealing hidden resources like forums or databases. Tools like Ahmia and OnionScan assist in this process.</p>
<h3>Finding Usernames:</h3>
<p><strong>Username Search Engines</strong>: Pipl, UserSearch, and IntelTechniques Username searches allow users to search for usernames across multiple platforms, revealing profile information and activity.</p>
<p><strong>Social Media Platforms</strong>: Platforms like Twitter, Instagram, and LinkedIn enable searching for users by their usernames, providing insights into their online presence.</p>
<p><strong>Username Generators</strong>: Tools like SpinXO and UsernameGenerator help generate potential usernames based on keywords, aiding in username discovery.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*EwIw1EwMWV4GOjz8"></figure><p>By mastering these fundamental OSINT techniques and tools, beginners can unlock valuable insights from publicly available information, empowering them to navigate the digital world with confidence.</p>
<h3>Sherlock:-</h3>
<p>Sherlock is an open-source tool designed for digital forensic investigation and Open Source Intelligence (OSINT) gathering. It’s primarily used for collecting and analyzing information from various social media platforms, websites, and online resources to aid in investigations, threat intelligence, or reconnaissance activities.</p>
<p><a href="https://github.com/sherlock-project/sherlock.git">GitHub - sherlock-project/sherlock: 🔎 Hunt down social media accounts by username across social networks</a></p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/813/0*bQEfpqYq0oHXEw_z.png"></figure><h3>Conclusion:-</h3>
<p>In conclusion, OSINT provides a transformative journey into uncovering hidden truths from publicly available information. With tools like Harvester and Shodan, coupled with advanced techniques such as Google Dorking and profile analysis, individuals navigate the digital realm with confidence. Collaboration and expertise enhance exploration, empowering novices to decode the complexities of the modern world. Additionally, integrating paid and ethical tools ensures comprehensive and responsible information gathering practices.</p>
<h3>Contributions —</h3>
<p><a href="https://medium.com/@dakshbhagwani444">Daksh Bhagwani</a></p>
<p><a href="https://medium.com/@adityadas.2005">Aditya Das</a></p>
<p><a href="https://medium.com/@devansh6061">Devansh Gupta</a></p>
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=b39db0421dd4" width="1" height="1" alt=""><hr>
<p><a href="https://infosecwriteups.com/the-power-of-open-source-intelligence-osint-ctf-newbies-b39db0421dd4">The Power of Open Source Intelligence | OSINT | CTF Newbies</a> was originally published in <a href="https://infosecwriteups.com/">InfoSec Write-ups</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.</p>


The Power of Open Source Intelligence | OSINT | CTF Newbies


<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*IZT2beZ7rakLYQWI.png"></figure><p>Solving Web CTF enhances our skill to do bug bounty programs where we find web vulnerabilities in real world Web applications and report it. In return, either we get paid or get Hall Of Fame.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/398/0*sQRtdgDCrNXIjjdC"></figure><p>The most common Web Vulnerabilities are:</p>
<h4>1) SQL INJECTION</h4>
<p>SQL injection enables an attacker to manipulate the queries that an application sends to its database. This manipulation grants the attacker unauthorized access to view data within the database.</p>
<p>Furthermore, SQL injection can escalate to remote code execution, potentially granting the attacker control over the web server where the application is hosted.</p>
<p>Despite being an older vulnerability, SQL injection remains prevalent in various forms, largely due to improper sanitization of user inputs, which allows them to be directly inserted into SQL queries. It allows the attacker to create, read, update, alter, or delete data stored in the backend database.</p>
<h4>How does SQL injection work?</h4>
<p>Imagine a website that authenticates users based on username and password. The URL looks like this:</p>
<p><a href="https://www.example.com/auth/username=user&amp;password=mypassword">https://www.example.com/auth/username=user&amp;password=mypassword</a></p>
<p>The vulnerable code on the server looks like this:</p>
<pre>&lt;?php<br>$username = $_GET['username']; <br>$password = $_GET['password'];<br>$result = mysql_query("SELECT * FROM users WHERE username='$username' AND password=’$password");<br>?&gt;</pre>
<p>When this request is reached at server, if the username and password are placed in an SQL query directly without any filtering or sanitization, it will look like this:</p>
<p>SELECT * FROM users WHERE username='user' AND password='mypassword'</p>
<p>It retrieves all columns where username is user and password is mypassword.</p>
<p>Now if I change the URL like the following:</p>
<p><a href="https://www.example.com/auth/username='&amp;password=mypassword">https://www.example.com/auth/username='&amp;password=mypassword</a></p>
<p>The resultant query would be like this:</p>
<p>SELECT * FROM users WHERE username='' AND password='mypassword'</p>
<p>We closed the string where the username was supposed to be there.</p>
<p>Now if we make the URL as</p>
<p>https://www.example.com/auth/username=' OR 1==1 -- &amp;password=mypassword</p>
<p>The Resultant query would look like:</p>
<p>SELECT * FROM users WHERE username='' OR 1==1 -- AND password='mypassword'</p>
<p>What does the ‘ OR 1==1 -- payload mean and do?</p>
<p>The ' closes the string literal in the query where the actual username is supposed to come. The OR operator checks whether either of the condition results is true.</p>
<p>The 1==1 condition is always true. So the whole where clause returns true.</p>
<p>The -- comments out the rest of the query.</p>
<p>Now what happens when the query is executed in the database?</p>
<p>It retrieves all columns(*) from table users where the username is TRUE (because 1==1 is always true) and comments out the rest of the query.</p>
<p>This way we can essentially bypass the authentication method of websites.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/842/0*UGbZWIi29xBSTxz9.png"></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/816/0*nuz_tfoL9yL4rcGV.png"></figure><p>The above input is the most common approach used for SQLi. The injection allows the attacker to pull all the registered users from the database.</p>
<h3>2) Command Injection</h3>
<p>Command Injection or Remote Code Execution(RCE) is one of the most dangerous vulnerabilities that exists. It allows an attacker to run OS commands on the web server through the vulnerable web app. It allows an attacker to take complete control of the server. The attacker can read or edit files, read user information, read or edit source codes, delete important files, break the server, get internal network details, etc.</p>
<h3>How does Command Injection work?</h3>
<p>If a web app takes user input and executes it in a shell in the server. It could be used to execute OS commands on the server.</p>
<p>Imagine a web app takes an IP address as user input to test the ping on the given IP address.</p>
<p>The code on the server looks something like this:</p>
<pre>import os<br>domain = user_input() #IP address<br>os.system('ping ' + domain)</pre>
<p>If the user gives an IP 10.10.10.1 as input, the command would look like this. ping 10.10.10.1</p>
<p>If we could add some OS commands we could execute any command on the server.</p>
<p>The attacker could put 10.10.10.1; ls as input, and the resultant command would look like this:</p>
<p>ping 10.10.10.1 ; ls</p>
<p>after pinging the IP, ls lists the files in the present directory</p>
<p>In this way, we can execute any OS commands on the server including spawning a reverse shell to our system and gaining full access to the server.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/839/0*DoD_cAcovjLfaJDM.png"></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/829/0*XrgTzcFJD3LDmXqY.png"></figure><p>You can use a pipeline to inject the system by entering the following input into the field.</p>
<p>127.0.0.1;ls</p>
<p>After the results of PING, we can see the list of files in the current directory. (ls lists all files in the current directory)</p>
<p>Further, we can even spawn in reverse shell from the host server to our server.</p>
<h3>3) DIRECTORY TRAVERSAL</h3>
<p>It is a type of HTTP exploit in which a hacker uses the software on a web server to access data in a directory other than the server’s root directory. If the attempt is successful, the threat actor can view restricted files or execute commands on the server. Directory traversal is also known as directory climbing, backtracking and file path traversal vulnerabilities. It is similar to Structured Query Language injection (SQLi) and cross-site scripting (XSS) in that they all involve code injection.</p>
<h3>How does directory traversal work?</h3>
<p>Imagine a web application that serves files based on user input, such as a file download feature. The application takes a file path from the user and serves the corresponding file. However, the application does not properly validate or sanitize the input, allowing the attacker to manipulate the file path and access files outside of the intended directory.</p>
<p>For instance, suppose the application serves files from the directory <strong>/var/www/files/</strong>. A legitimate request might look like this:</p>
<pre>&lt;http://example.com/download?file=example.txt&gt;</pre>
<p>The application would serve the file <strong>example.txt</strong> from the <strong>files</strong> directory. However, an attacker can manipulate the file parameter to access sensitive files outside of the <strong>files</strong> directory. For example:</p>
<pre>&lt;http://example.com/download?file=../../../../../etc/passwd&gt;</pre>
<p>In this case, the attacker used <strong>../</strong> to traverse the directory structure several times and then accessed the <strong>/etc/passwd</strong> file, which typically contains user account information. If the application is vulnerable, it will serve the contents of <strong>/etc/passwd</strong> to the attacker, potentially exposing sensitive information.</p>
<h3>Impact of a directory traversal attack</h3>
<p>One of the significant impacts of a directory traversal attack is unauthorized access to sensitive information. By exploiting vulnerabilities in the application’s file-handling mechanisms, attackers can traverse directories and access files containing critical data such as user credentials, configuration files, or proprietary information. This can lead to severe consequences such as data breaches, identity theft, or compromise of intellectual property.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/917/0*2IMPsGYnUyX-ZWwL.png"></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*PpshrC4STdQizgAI.png"></figure><p>From the above example, the attacker can overwrite the sample.php file by using the directory transverse.</p>
<h3>4) CROSS-SITE REQUEST FORGERY</h3>
<p>Cross-Site Request Forgery (CSRF) is an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated. CSRF attacks exploit the trust a Web application has in an authenticated user. (Conversely, cross-site scripting (XSS) attacks exploit the trust a user has in a particular Web application). A CSRF attack exploits a vulnerability in a Web application if it cannot differentiate between a request generated by an individual user and a request generated by a user without their consent.</p>
<h3>How does Cross-Site Request Forgery work?</h3>
<p>Imagine there’s a banking website where users can transfer funds to other accounts. The website uses a simple HTML form to perform fund transfers:</p>
<pre>&lt;form action="&lt;https://bank.com/transfer&gt;" method="post"&gt;<br>    &lt;input type="hidden" name="amount" value="1000"&gt;<br>    &lt;input type="hidden" name="toAccount" value="attackerAccount"&gt;<br>    &lt;input type="submit" value="Transfer Funds"&gt;<br>&lt;/form&gt;</pre>
<p>Now, imagine an attacker creates a malicious website and embeds the following HTML code:</p>
<pre>&lt;img src="&lt;https://bank.com/transfer&gt;" style="display:none" onload="document.forms[0].submit()"&gt;</pre>
<p>When a user who is logged into the banking website visits this malicious website, their browser automatically sends a request to <strong>https://bank.com/transfer</strong> with the parameters <strong>amount=1000</strong> and <strong>toAccount=attackerAccount</strong>, effectively transferring $1000 to the attacker's account.</p>
<h3>Impact of a Cross-Site Request Forgery Work</h3>
<p>One significant impact of CSRF attacks is that they enable unauthorized actions to be performed on behalf of the victim without their knowledge or consent. Attackers can exploit CSRF vulnerabilities to trick authenticated users into unknowingly performing actions on web applications, such as transferring funds, changing account settings, or submitting forms. Since the requests originate from the victim’s browser with their authenticated session, they may go unnoticed by the victim until it’s too late, leading to financial loss, data corruption, or other adverse consequences.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1000/0*KbOGs3Jbf0vlA76H.png"></figure><h3>5) Cross-Site Scripting (XSS)</h3>
<p>Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser-side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.</p>
<h3>How does a Cross Site Scripting attack work?</h3>
<p>Imagine there’s a vulnerable website that has a search feature allowing users to search for products. The search query is displayed on the search results page without proper input sanitization. An attacker exploits this vulnerability to inject malicious JavaScript code into the search query parameter.</p>
<p><strong>Vulnerable Website</strong>:</p>
<pre>&lt;html&gt;<br>&lt;head&gt;<br>    &lt;title&gt;Product Search&lt;/title&gt;<br>&lt;/head&gt;<br>&lt;body&gt;<br>    &lt;form action="/search" method="get"&gt;<br>        &lt;input type="text" name="q" placeholder="Search products..."&gt;<br>        &lt;input type="submit" value="Search"&gt;<br>    &lt;/form&gt;<br>&lt;/body&gt;<br>&lt;/html&gt;</pre>
<p><strong>Exploited Search Query Parameter</strong>:</p>
<p>Suppose the attacker enters the following search query into the search field:</p>
<pre>&lt;script&gt;alert('XSS Attack!');&lt;/script&gt;</pre>
<p><strong>Search Results Page (Vulnerable)</strong>:</p>
<p>The search results page displays the search query without proper input sanitization:</p>
<pre>&lt;html&gt;<br>&lt;head&gt;<br>    &lt;title&gt;Search Results&lt;/title&gt;<br>&lt;/head&gt;<br>&lt;body&gt;<br>    &lt;p&gt;Search results for: &lt;script&gt;alert('XSS Attack!');&lt;/script&gt;&lt;/p&gt;<br>    &lt;!-- Other search results here --&gt;<br>&lt;/body&gt;<br>&lt;/html&gt;</pre>
<p>When a user visits the search results page, the injected JavaScript code executes in the context of the vulnerable website. In this case, it displays an alert dialog with the message “XSS Attack!”.</p>
<h3>Impact of a Cross-Site Scripting attack</h3>
<p><strong>Compromise of Sensitive Information</strong>: One significant impact of an XSS attack is the potential compromise of sensitive information. Attackers can exploit XSS vulnerabilities to steal cookies, session tokens, or other authentication credentials from unsuspecting users. This compromised information can be used to impersonate users, perform unauthorized actions on their behalf, or gain unauthorized access to their accounts and sensitive data.</p>
<h3>How to prevent a Cross-Site Scripting attack</h3>
<p>Preventing Cross-Site Scripting (XSS) attacks involves implementing various security measures within web applications.</p>
<ol><li>
<strong>Input Validation and Sanitization</strong>:</li></ol>
<ul>
<li>Validate and sanitize all user input, including form fields, URL parameters, and cookies, to ensure they do not contain malicious code.</li>
<li>Use server-side input validation to enforce strict rules on input data formats and lengths.</li>
<li>Sanitize output by encoding user-generated content before displaying it in web pages. Use HTML entity encoding, JavaScript escaping, or other appropriate encoding techniques to prevent the interpretation of user input as executable code.</li>
</ul>
<p><strong>2. Content Security Policy (CSP)</strong>:</p>
<ul>
<li>Implement a Content Security Policy (CSP) to mitigate XSS attacks by specifying the allowed sources of content, scripts, and other resources that can be loaded by the web page.</li>
<li>Utilize CSP directives such as <strong>script-src</strong>, <strong>style-src</strong>, and <strong>default-src</strong> to restrict the domains from which scripts, stylesheets, and other resources can be loaded.</li>
<li>Enable the <strong>script-src 'nonce'</strong> or <strong>script-src 'strict-dynamic'</strong> directive to prevent inline script execution and only allow scripts with trusted nonces or hashes to execute.</li>
</ul>
<p>We could use the following payload to detect XSS in any web app:</p>
<p>&lt;script&gt;alert(1)&lt;/script&gt;</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/822/0*9zWeztWCVH3nPvZ3.png"></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/840/0*_ZJSRb6F9I1KMwMx.png"></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*YwdYPUd1f4Dj8vGI.png"></figure><h3>RESOURCES</h3>
<ul>
<li>
<strong>CTF walkthroughs</strong>: Do a google search for walkthroughs or writeups of CTFs when you are unable to solve a CTF.</li>
<li>
<strong>Twitter Accounts of Infosec researchers</strong>: Infosec researchers often share their new research or tricks on their Twitter pages.</li>
<li>
<strong>Stackoverflow</strong>: Search for answers to commonly asked questions on technologies you are trying to hack.</li>
</ul>
<h3>CONTRIBUTION:</h3>
<p><a href="https://medium.com/@1406utkarsh">Utkarsh Jaiswal</a></p>
<p><a href="http://medium.com/@rohithmathew04">Rohith Mathew</a></p>
<p><a href="https://medium.com/@devansh6061">Devansh Gupta</a></p>
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=233293a2a739" width="1" height="1" alt=""><hr>
<p><a href="https://infosecwriteups.com/decoding-the-web-exploring-the-depths-of-exploitation-ctf-newbies-233293a2a739">Decoding the Web: Exploring the Depths of Exploitation | CTF Newbies</a> was originally published in <a href="https://infosecwriteups.com/">InfoSec Write-ups</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.</p>


Decoding the Web: Exploring the Depths of Exploitation | CTF Newbies


<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*13_dJV7YO890pFtOfrOnTQ.png"></figure><h3>Introduction</h3>
<p>These challenges are designed in such a way that forces the contestants to understand what a program does.</p>
<p>Reverse Engineering as the name suggests, is reversing something that is already made, to learn its internals and working. It is the process of Analyzing and Understanding, A particular piece of code, software, electronics, etc…….</p>
<h3>Why do you need such challenges in CTF ?</h3>
<p>In basic CTF’s Reversing challenges are mostly a piece of compiled software, for you to reverse, understand, and break with your skills.</p>
<p>This skill set translates to real-world security scenarios where attackers might use similar techniques to exploit software flaws. These challenges will train you to be more experienced Reverse Engineers, which will help you a lot when tackling real-world problems.</p>
<h3>Where Reversing-Engineering is used in the real world:-</h3>
<p>How do you think there is cracked software for you to use?</p>
<p>How do you think people can break multiple malware attacks?</p>
<p>How do you think Game-mods are made?</p>
<p>Yes, Reversing-Engineering is a very vast topic and sure can’t be explained or understood in a single blog post.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/808/0*bRKJwHV3jgUA5YNV"></figure><h3>Pre-requisites:</h3>
<p>Reversing-Engineering is a complex topic and it goes deeper as you drive in, but…. here are some basics you need to start reversing</p>
<p>1. C/C++ (Basic Understand)</p>
<p>2. ASM (x86_64) (at least basics are recommended)</p>
<p>3. basic use of Debuggers (GDB, x64dbg, Ollydbg) etc……</p>
<p>4. basic use of Disassemblers (IDA, Ghidra, BinaryNinja) any of these.</p>
<h3>About some tools:</h3>
<p>You should have some basic knowledge of these tools before diving deep into rev challenges.</p>
<h3>Disassemblers:-</h3>
<h4>1. Hexrays IDA</h4>
<p>IDA is the most used and oldest disassembler currently, IDA is preferred by more seasonal Reverse-Engineers because of its brilliant Pseudo-code generation.</p>
<h4>2. Ghidra</h4>
<p>Ghidra is a free Open-Source reverse-engineering tool which is developed by the NSA (National Security Agency), Its Pseudo-code generator is good enough and it has a lot more potential to grow being an Open-Source tool.</p>
<h4>3. Binary Ninja</h4>
<p>Binary Ninja is the most recent disassembler, It has a good Pseudo-code generator and a really good user interface.</p>
<h3>Debuggers:-</h3>
<h4>1. GDB</h4>
<p>Gdb is a powerful debugger for debugging Linux binaries, Although Vanilla-gdb feels a little crampy to use, We recommend applying some plugins like…. Peda, Pwndbg, and Gef, Try all 3 and use what you prefer.</p>
<h4>2. x64-dbg</h4>
<p>This is an Open-Source debugger for debugging Windows software, it is the most used and very powerful debugger for Windows.</p>
<p>There are a lot more tools, to use while doing specific tasks on Rev challenges, You learn about them as you go on, your journey of Reverse-Engineering, the above tools are more than enough to get started with.</p>
<h3># Trying to solve some challenges:</h3>
<p>Solving a “compiled-C” type Reversing challenge involves using a combination of Disassemblers and Debuggers to understand the control flow of the program, As you dive deep into learning how to reverse programs, You’ll encounter and learn how to defeat multiple Anti-Debug techniques, packers etc….., which makes your work harder and harder.</p>
<h3>Wanna See It Happening Live?</h3>
<p>Let’s take a look at a simple CTF problem.</p>
<p>Here is the link to the CTF problem. You can go ahead and try it on your own.</p>
<p><a href="https://play.picoctf.org/practice/challenge/175?category=3&amp;page=1">picoCTF — picoGym Challenges</a></p>
<p>This is a very basic rev CTF problem. As you see, the only thing we have here is a <a href="http://crackme.py/">crackme.py</a> file. We will download the file and open it.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*1etLS1IkjMWMmDZsktlXng.png"></figure><p>Opening the file in VS Code we get a Python script, like this</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1000/0*PoTeMdh4LK9NCLRw.png"></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/1000/0*oNMOj7ro57GYqQ5t.png"></figure><p>If you look in the header of the program, it has comments telling about an important number that is encrypted.</p>
<p>Then, there are 2 functions decode_secret() and choose_greatest().</p>
<p>As you know according to Python’s workflow, the execution will start by calling the choose_greatest() function.</p>
<p>Let’s try and call the other function.</p>
<p>Well, this function needs a parameter. If you look closely, you will find a string declared at the top named bezos_cc_secret.</p>
<p>we will try giving that as an input to the function call.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/537/0*I-WHrii3Q6e--Vu-.png"></figure><p>now, if you run the program, you will get the output</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/663/0*j-KdK6730EjNKWGS.png"></figure><p>That’s your flag.</p>
<p>The above one is a basic Python-Rev challenge, Now we’ll look at a basic binary reversing……</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/753/0*YB3GE1AEqqRWuQBz.png"></figure><p>Getting started, We are given a binary called “chall”, forget about the “.c” file, it’s just my work.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/665/0*aA8JPAR0_TA8zTfq.png"></figure><p>Executing the binary, We were asked to enter some password, Try something random, gave us “Wrong Pass”, So….. we can see that the Binary is performing some kind of Password-Check.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1000/0*k8noRc1YTw08jSor.png"></figure><p>Loading the binary into “Binary Ninja”, you can see that we are shown with some de-compiled code, If you take a quick look, you’ll know what the actual password is, this is a very basic strcmp check with our input and password, let’s not stop here, we’ll explore some formats that Binary Ninja can display in.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1000/0*dPgBUHXU4eFXow5j.png"></figure><p>Looking there, we can see the disassembly, so let’s look at it.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1000/0*e_cYeQ_fS1x8eNvT.png"></figure><p>You see, this is how disassembly looks, If you are a little experienced, you should be able to understand this disassembly pretty easily, now…. let’s see how else we can look at it.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/887/0*2BZRXDGGVWdYPZE0.png"></figure><p>Binary Ninja offers a Graph view too, So…. let’s just look into it.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1000/0*7qGOhbc8hHnMXnHu.png"></figure><p>Looking at the graph view, We can depict the control flow easily without following much.</p>
<p>This may look overwhelming at the start, But…. you’ll get used to it once you start doing it.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1000/0*UL7UpxL2beYXTMVR.png"></figure><p>Now, going back to the Pseudo-C code, We’ll find that “Secret-Password” is the actual password, let’s go ahead and try it.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/657/0*lnYVC7I5CKrVt3Ic.png"></figure><p>You see, It works! , This is how you normally approach a reversing challenge.</p>
<p>Now that you have a basic understanding of what reversing engineering is, here are some blogs/videos to help you get started.</p>
<ul>
<li><a href="https://wiki.bi0s.in/reversing/roadmap/">https://wiki.bi0s.in/reversing/roadmap/</a></li>
<li><a href="https://www.youtube.com/watch?v=iyAyN3GFM7A&amp;list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN">https://www.youtube.com/watch?v=iyAyN3GFM7A&amp;list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN</a></li>
<li><a href="https://www.youtube.com/@pwncollege">pwn.college — YouTube</a></li>
</ul>
<p>You can also practice your skills at sites like</p>
<ul>
<li><a href="https://crackmes.one/">https://crackmes.one</a></li>
<li><a href="https://pwn.college/">https://pwn.college</a></li>
<li><a href="https://picoctf.org/">picoCTF — CMU Cybersecurity Competition</a></li>
</ul>
<p>and many more…</p>
<p>You can always google for more :)</p>
<p>Contribution —</p>
<p><a href="https://medium.com/@alex_zander">Sai Shashank Reddy</a></p>
<p><a href="https://medium.com/@vc9378">Vitthal Choudhary</a></p>
<p><a href="https://medium.com/@devansh6061">Devansh Gupta</a></p>
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=cbd0aa47a90d" width="1" height="1" alt=""><hr>
<p><a href="https://infosecwriteups.com/reverse-engineering-ctf-newbies-part-1-cbd0aa47a90d">Reverse Engineering | CTF Newbies | Part 1</a> was originally published in <a href="https://infosecwriteups.com/">InfoSec Write-ups</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.</p>


Reverse Engineering | CTF Newbies | Part 1


<figure><img alt="" src="https://cdn-images-1.medium.com/max/612/0*_aOtgkTG05K3okEq.png"></figure><p>Capture The Flag (CTF) is a cybersecurity competition where participants solve the challenges of various categories to find the hidden “flag”. These flags are strings or code type that are strategically hidden inside the files, computer systems and networks.</p>
<p>Participants often works in teams, using their skills and knowledge to solve the challenge. Challenges may include tasks such as exploiting vulnerabilities in software, analyzing network traffic, deciphering encrypted messages, or reverse engineering software binaries.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1000/0*gNJuhqgeV7IK_lRB.png"></figure><p>There are two types of CTFs :-</p>
<h4>1. Jeopardy-style CTF -</h4>
<p>It is the most common format of CTF. The challenges are divided into categories, each representing different types of cybersecurity concepts and skill sets. These challenges are sub-categories as easy , medium and hard with different point ranges.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/578/0*ldbc1uu5C7MfmXSO.png"></figure><p>Categories that are there in Jeopardy-style CTFs are :-</p>
<ol><li>
<strong>Cryptography</strong> — challenges are based on decrypting the encoded message and solving the cryptographic algorithm.</li></ol>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/500/0*J5194MDJlaPUNSoI.gif"></figure><p>Type of challenges in crypto :-</p>
<ol>
<li>Cracking Classical Ciphers: These challenges often involve encrypted messages using well-known techniques like Caesar ciphers, Vigenere ciphers, or XOR. The key lies in recognizing the cipher type and using manual or automated methods to crack it.</li>
<li>Exploiting Weak Implementations: CTFs might present scenarios where encryption algorithms are poorly implemented or use weak keys. Your job is to find these vulnerabilities and bypass the encryption to reveal the flag (the hidden message or data).</li>
<li>Modern Crypto with a Twist: Challenges can involve modern encryption standards like AES or RSA, but with a twist. There might be hints about weaknesses in the configuration or key management, requiring you to think outside the box to exploit them.</li>
</ol>
<p>2.<em> </em><strong>Reverse Engineering</strong> — as the name suggests, reversing something that is already made, to learn its internals and working. It is the process of Analyzing and Understanding, A particular piece of code, software, electronics etc.</p>
<p>Challenges you will encounter :-</p>
<p>a. Disassembly and decompilation — The program you’re given will likely be obfuscated and difficult to read directly. Tools like IDA Pro or Ghidra will help you disassemble the code into assembly language, which is a low-level representation but still cryptic. Decompilers can try to turn assembly back into a higher-level language like C, but they might not always be perfect.</p>
<p>b. Understanding logic and control flow — You’ll need to analyze the assembly code to grasp how the program works. This involves tracing execution paths, identifying functions, and understanding conditional statements and loops.</p>
<p>3. <strong>Web Exploitation </strong>— finding the flag by finding and exploiting the vulnerabilities in web applications.</p>
<p>Common vulnerabilities :-</p>
<p>a. Injection Flaw — These vulnerabilities occur when user input is not properly sanitized before being used in database queries or system commands. This can allow attackers to inject malicious code (like SQL injection or command injection) to manipulate the application or steal data.</p>
<p>b. Broken Authentication — Challenges might involve weak login mechanisms, vulnerabilities in session management (like session hijacking), or lack of proper authorization checks. By exploiting these, you could potentially bypass logins or gain access to unauthorized areas.</p>
<p>c. cross-site scripting (XSS) — If the application allows users to inject malicious scripts into web pages, it might be vulnerable to XSS. This could allow attackers to steal user cookies, redirect users to malicious sites, or deface the website.</p>
<p>d. Hidden Functionalities — Sometimes, developers leave behind debug pages, test functionality, or hidden directories that contain sensitive information or functionalities useful for exploiting the application.</p>
<p>4. <strong>Forensics</strong> — analyzing and extracting hidden data from files, disk images or network traffic. typically involve analyzing digital artifacts or investigating simulated cybercrime scenarios to uncover hidden information, solve puzzles, or identify vulnerabilities. These challenges often require participants to utilize various forensic techniques, tools, and methodologies.</p>
<p>5. <strong>Binary Exploitation </strong>— Involves finding and exploiting vulnerabilities in compiled binary executables, typically written in languages like C or C++. Participants must analyze the binary, identify security flaws, and craft exploits to gain unauthorized access or control over the target system.</p>
<p>6. <strong>OSINT</strong> — Open Source Intelligence category typically involves challenges that require participants to gather information from publicly available sources on the internet to solve a given problem or find hidden flags.</p>
<p>7. <strong>Miscellaneous</strong> — challenges can encompass a wide range of topics, including steganography, programming, and logic puzzles.</p>
<h4>2. Attack-defense style CTF —</h4>
<p>It is another type of CTF where teams compete against each other in a shared network. In this CTF one team has to attack another team as well defending their own systems.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*QW6VKJNW1Nf7Pmnv.png"></figure><p>ENVIRONMENT —</p>
<p>Teams are provided with virtual machines that have vulnerabilities in them. With that machine they have to attack as well as defend it .</p>
<p>Teams are provided with tools and resources to launch attacks against the system of other teams. The goal is to exploit vulnerabilities, gain access and steal the flags.</p>
<p>Scoring is based on the successful attack and successful defense against other teams.</p>
<p>These competitions help participants develop practical skills in network defense, vulnerability analysis, exploit development, and incident response.</p>
<h4>RESOURCES -</h4>
<ul>
<li>
<a href="https://ctftime.org/">https://ctftime.org/</a> — CTF event tracker.</li>
<li>
<a href="https://github.com/SandySekharan/CTF-tool">https://github.com/SandySekharan/CTF-tool</a> — information on CTF tools.</li>
<li>
<a href="https://github.com/gregalletti/CTF_tools">https://github.com/gregalletti/CTF_tools</a> — useful sites and tools.</li>
</ul>
<h4>CONCLUSION -</h4>
<p>Both types of CTFs enhance your skills in the field of cybersecurity. Solving challenges in jeopardy-based and exploiting machines in attack-defense based will give a brief knowledge on how things in cybersecurity work.</p>
<p>HAPPY HACKING :)</p>
<h4>CONTRIBUTION —</h4>
<p><a href="https://medium.com/@devansh6061">Devansh Gupta</a></p>
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=3ab9513ab7d3" width="1" height="1" alt=""><hr>
<p><a href="https://infosecwriteups.com/ctf-where-experts-play-and-flags-fall-ctf-newbies-3ab9513ab7d3">CTF: Where Experts Play And Flags Fall | CTF Newbies</a> was originally published in <a href="https://infosecwriteups.com/">InfoSec Write-ups</a> on Medium, where people are continuing the conversation by highlighting and responding to this story.</p>


CTF: Where Experts Play And Flags Fall | CTF Newbies


<h3>Can JWT Tokens Be Cracked ? If So How?</h3>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/448/1*Nn4lerGUf1Vd_JcSg4_vmw.png"></figure><h4><strong>What is JWT Token ?</strong></h4>
<p>JSON Web Token is a proposed Internet standard for creating data with optional signature and/or optional encryption whose payload holds JSON that asserts some number of claims. The tokens are signed either using a private secret or a public/private key.</p>
<h4>Understanding JWTs in Detail:</h4>
<p>JWTs consist of three parts: Header, Payload, and Signature. The Header typically specifies the type of token and the signing algorithm. The Payload contains claims or information about the user, and the Signature is created using a secret key, ensuring the integrity of the token.</p>
<p><strong>For example:</strong></p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/900/0*5SmwyZ-QQKutkBsC.png"></figure><p>Here, The <strong>Red</strong> part is the <strong>header</strong>, the <strong>Purple </strong>part is the <strong>payload </strong>and the <strong>Blue </strong>part is the <strong>signature </strong>of the token.</p>
<p><a href="https://jwt.io/">JWT.IO</a></p>
<p>The above website is very helpful for getting the details about a jwt token.</p>
<h4>Now How can somebody crack it ?</h4>
<p>Although Jwt tokens are very safe, there are some weaknesses an attacker could exploit to crack it.</p>
<ol>
<li>
<strong>Stolen Secrets</strong>: If an attacker somehow gains access to the secret key used for signing JWTs, they can create their own valid tokens.</li>
<li>
<strong>Brute Force Attacks</strong>: Since JWTs are often signed with a secret key, an attacker might attempt a brute force attack to guess the key.</li>
<li>
<strong>Token Sniffing</strong>: If an attacker can intercept (sniff) the JWTs during transmission, they may be able to use captured tokens to impersonate users.</li>
<li>
<strong>Token Expiration Manipulation</strong>: JWTs typically have an expiration time. If an attacker can somehow manipulate or extend the expiration time, they may be able to use an expired token.</li>
<li>
<strong>Insecure Storage</strong>: If JWTs are stored on the client side (e.g., in a browser’s local storage) and not securely managed, an attacker might attempt to steal them.</li>
</ol>
<h4>For Example I am going to take a question from a ctf that took place recently.</h4>
<h4>Beginner/Secret-of-Kurama</h4>
<p>Madara attacked leaf village. everyone wants Naruto to turn into Nine-Tails, Naruto don’t know what’s the SECRET to change its role to ‘NineTails’? can you as a shinobi help Naruto??? username: Naruto Password: Chakra</p>
<p><a href="http://xx.xxx.xxx.xx/">http://xx.xxx.xxx.xx:xxxx/</a></p>
<p>This is a question from <strong>BackDoor CTF.</strong></p>
<p>When we go on the given website we get /secret_of_Kurama page.</p>
<p>We also have a jwt token:</p>
<pre>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6Ik5hcnV0byIsInJvbGUiOiJzaGlub2JpIn0.WJv_YcVsRV15PqzGpq10-w5i2mJ_BI1mBzkZMtAPnIQ</pre>
<p>Using the jwt.io website we get</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*ZhUYt1w1Zt_3Xosn3MUw7g.png"></figure><p>From the question we know that we have to change to role to NineTails.</p>
<p>But that’s not it, we also need the secret key to verify the signature and create a valid jwt.</p>
<p>So we can use hashcat to possibly crack it. on using hashcat we get this:</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*bGsL_U-UtbVHL9tDEvDxUw.jpeg"></figure><p>As we can see the secret is “minato”.</p>
<p>Now we can use this to create a valid token.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*gjjgfU9evl2u1XjqGTdKIA.png"></figure><p>On using this token we get the flag!!</p>
<p>This was a very easy example of cracking a jwt token.</p>
<h4>There are many other jwt tokens which uses Different Algorithms and are harder to crack like:</h4>
<h4>1. HMAC (Hash-based Message Authentication Code):</h4>
<ul>
<li>Uses a shared secret key for hashing the token.</li>
<li>Depends on a strong secret key and vulnerable if the key is exposed.</li>
</ul>
<h4>2. RSASSA (RSA Signature Algorithm):</h4>
<ul>
<li>Utilizes a pair of public and private keys for signing.</li>
<li>High security if keys are properly managed,private key confidentiality is crucial.</li>
</ul>
<h4>3. ECDSA (Elliptic Curve Digital Signature Algorithm):</h4>
<ul>
<li>Similar to RSASSA but employs elliptic curve cryptography.</li>
<li>Efficient and secure with proper key management.</li>
</ul>
<h4>4. None Algorithm:</h4>
<ul>
<li>Token is unsigned, used when transport is secure (HTTPS).</li>
<li>Use cautiously, susceptible to tampering, signing recommended in production.</li>
</ul>
<p><strong>Now If you have a website using Jwt tokens and want to secure it you can follow the following:</strong></p>
<ol>
<li>
<strong>Use Strong Key Management</strong>: Employ long and complex secret keys. Regularly rotate keys and ensure they are stored securely.</li>
<li>
<strong>Implement Proper Validation</strong>: Validate the signature of incoming JWTs to ensure they haven’t been tampered with.</li>
<li>
<strong>Encrypt Sensitive Information</strong>: If the information in the JWT payload is sensitive, consider encrypting it to add an extra layer of protection.</li>
<li>
<strong>Token Revocation:</strong> Implement mechanisms to revoke or invalidate tokens if suspicious activity is detected.</li>
<li>
<strong>Secure Transmission</strong>: Use HTTPS to encrypt the communication between the client and server, preventing token sniffing during transmission.</li>
<li>
<strong>Token Expiration Policies:</strong> Enforce and properly validate token expiration times to minimize the window of opportunity for attackers.</li>
</ol>
<h4>Contribution:</h4>
<p><strong>Writer:</strong></p>
<p><em>Om Arora</em> | <strong><em>Binary</em></strong></p>
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=42dafe72bf43" width="1" height="1" alt="">


Can JWT Tokens Be Cracked ? If So How?

Memory Forensics -The Road Not Taken


<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*hzOKQZybhg7UmdcGI2PQkA.png"></figure><h3><strong><em>What Is Digital Forensics?</em></strong></h3>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/480/0*txbrR0LKXVJvs4kA.gif"></figure><p>As the name suggests, it is a branch of forensic science whose main aim is to investigate the crimes that occur over digital platforms. There are many tools available over the <em>internet</em> that help experts identify/find loopholes or malicious files within the system. The primary goal is to find clues and then capture the criminals (who think that they can do whatever they want on the <em>Internet</em> freely) and help prevent <em>it from happening</em> in the future.</p>
<h3><strong>Impact Of Study Of Digital Forensics On Cyber Crimes</strong></h3>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/498/0*WsHRRy3SP2EJj6Qy.gif"></figure><p>Nowadays, the internet is full of <em>everything</em>. You can find <em>anything</em> to learn; with this, there is a growth of cybercrimes accompanying the expansion of the internet. To control these situations, there is a dire need for this branch, with <em>like-minded</em> people who want to help others with their computing knowledge. For that reason, this branch <em>evolved</em> within a short period of time. Digital forensics is not just <em>much</em>, but it proves effective in controlling cybercrimes. The below data from India <em>demonstrates</em> how effective this digital forensics branch is.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/702/1*ttKM2A3_AoOU33zVYBLG7w.png"></figure><figure><img alt="" src="https://cdn-images-1.medium.com/max/702/1*LMVTWWqX4-UgOpbWogxr9w.png"></figure><h3>Approaches to Managing a Compromised System</h3>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/300/0*3yaRhvaZJK8BhmvG.gif"></figure><p><strong>Step 1: Acquisition or Imaging of Evidence</strong></p>
<p>In this initial stage, an image of the computer’s volatile memory (RAM) is captured. Simultaneously, an exact sector-level duplicate, often referred to as a “forensic duplicate,” is created for the media in question. To ensure accuracy, the original media and data are hashed using algorithms like SHA-1 or MD5. A comparison of the generated hash values is carried out to verify the accuracy of the duplicate copy.</p>
<p><strong>Step 2: Analysis</strong></p>
<p>The analysis phase primarily involves the recovery of deleted files and the extraction of registry information. This could encompass tasks such as listing user accounts or identifying attached USB devices. Moreover, a thorough investigation is conducted to determine the root cause behind the system’s compromise.</p>
<p><strong>Step 3: Reporting</strong></p>
<p>Following the analysis, a comprehensive report is generated, detailing the identified causes of compromise and related findings. By sharing this report, others can gain insights into what went wrong and take preventive measures to avert similar incidents in the future.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/720/1*n9e4r0G1qLqkHfK9qUjDDQ.png"></figure><h3><strong>Utilizing Digital Forensics Tools</strong></h3>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/498/0*Rc_NXkT0f-xqZkUu.gif"></figure><ol><li>Autopsy: This graphical user interface (GUI) tool plays a significant role in investigating compromised disks and files.</li></ol>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*BxMo9j6Wdjh--NsdYF5i5A.png"></figure><p>2. To initiate Autopsy, input sudo autopsy in your terminal, followed by entering your password. This will lead you to a screen similar to the one below:</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/748/1*MTF4jc1bHy6CTueLsdOZig.png"></figure><p>3. Click the link to access the Autopsy <a href="http://localhost/">localhost</a> server.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/418/1*0lyO2CiVtm5nzt7FQI1UPw.png"></figure><p>4. Upon reaching the server, you’ll be presented with three options. Select the most appropriate choice; in my case, I’m opting for the “New Case” option.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/283/1*V6QFJ8hiiuh7-JAxu1FbzA.png"></figure><p>5. Essential investigation details need to be filled in at this stage. After providing the information, click “Next.”</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/636/1*PeQm0kcaYyrBauZnh6AIJA.png"></figure><p>6. Now, it’s time to add an image. Select “Add Image.”</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/484/1*cVgDhQN-uhpQhYXjJC65ug.png"></figure><p>7. Input the file location. For this case study, I’ve already downloaded a test image file from the internet. After filling in the necessary file details, click “Next.”</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/1020/1*RV6TmpTuDpdY-WYq9Aq5qQ.png"></figure><p>8. Having successfully added the image, click “OK.”</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/566/1*Njz6H47_UuJHweFY4dmcJA.png"></figure><p>9. The ensuing screen offers a comprehensive image overview. To commence the investigation, select “Analyze.”</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/783/1*GLBvt-o8h_F6kzBp6yk8HA.png"></figure><p>10. A new window displays that the file system is NTFS. This window allows us to discover deleted files and examine their ASCII and hex values.</p>
<h3><strong>Additional Tools for Digital Forensics</strong></h3>
<ol>
<li>Scalpel</li>
<li>Guymager</li>
<li>Recuva (for data recovery), among many others.</li>
</ol>
<h3><strong>Conclusion</strong></h3>
<p>In conclusion, digital forensics plays a pivotal role in analyzing attacks and malware. Overall, its importance lies in ensuring data integrity, safeguarding individuals and businesses against cybercrime, and facilitating justice in legal cases.</p>
<figure><img alt="" src="https://cdn-images-1.medium.com/max/498/0*M-YNffziuby4BcCi.gif"></figure><h3><strong>References</strong></h3>
<ul>
<li><a href="https://en.wikipedia.org/wiki/Digital_forensics">Wikipedia — Digital Forensics</a></li>
<li><a href="https://factly.in/cyber-crimes-in-india-which-state-tops-the-chart">Factualy — Cyber Crimes in India</a></li>
<li><a href="https://www.spiceworks.com/tech/it-careers-skills/articles/digital-forensics-investigator/">Spiceworks — Digital Forensics Investigator</a></li>
</ul>
<h3><strong><em>Contribution:</em></strong></h3>
<p><strong>Writers:-</strong></p>
<p><em>Akshay Raj | </em><strong><em>Sudoer<br></em></strong><em>Gurupreet Singh |</em><strong><em> Binary</em></strong></p>
<p><strong>Designers:-<br></strong><em>Abhinav Shandilya</em> | <strong><em>Sudoer<br></em></strong><em>Shambhavee Swain</em> | <strong><em>Binary</em></strong></p>
<img src="https://medium.com/_/stat?event=post.clientViewed&amp;referrerSource=full_rss&amp;postId=f325960614d4" width="1" height="1" alt="">
