PicoCTF on an's security blog

Irish-Name-Repo 2

Wed, 03 Jun 2026 17:10:16 +0800

This is similar to Irish-Name-Repo 1, but with a filter active. Through trials and errors we can deduce that the filter actively blocks common SQL injection terms like UNION or OR.

To bypass this we can just apply the payload admin'-- into the username form. Not only will it skip the password verification but also avoid using those filtered terms.

PicoCTF

Wed, 03 Jun 2026 17:10:16 +0800

Web Exploitation

Wed, 03 Jun 2026 17:10:16 +0800

Irish-Name-Repo 1

Wed, 03 Jun 2026 16:39:16 +0800

Firstly, it’s good practice to purposely input trash values into the form. In this case we will be trying ' for username We can see that the users are kept in a SQLite3 database, and all our input are passed into the query without validation.

Thus we try the good old payload ' OR 1=1--, which will bypass the password check and we will get our flag

Power Cookie

Tue, 02 Jun 2026 14:20:16 +0800

We use Burp Suite to intercept the GET request, change the isAdmin cookie to True and we’ll get our flag:

IntroToBurp

Tue, 02 Jun 2026 14:06:16 +0800

This is a simple webpage asking for credentials, then an OTP: If we delete the otp parameter entirely before sending the POST request, we can actually bypass the check, per se: There we can get our flag. Pretty fun problem.

WebDecode

Tue, 02 Jun 2026 11:01:16 +0800

Upon accessing the source file for about.html, there is a peculiar flag: By trial and error, we can figure out this is Base64 encoded. Decode and we shall get our flag (not gonna lie took an embarassingly long time for this)

client-side-again

Tue, 02 Jun 2026 10:35:16 +0800

Upon checking the JS source code, we are greeted with this:

var _0x5a46 = ['daf93}', '_again_4', 'this', 'Password\x20Verified', 'Incorrect\x20password', 'getElementById', 'value', 'substring', 'picoCTF{', 'not_this'];
(function(_0x4bd822, _0x2bd6f7) {
 var _0xb4bdb3 = function(_0x1d68f6) {
 while (--_0x1d68f6) {
 _0x4bd822['push'](_0x4bd822['shift']());
 }
 };
 _0xb4bdb3(++_0x2bd6f7);
}(_0x5a46, 0x1b3));
var _0x4b5b = function(_0x2d8f05, _0x4b81bb) {
 _0x2d8f05 = _0x2d8f05 - 0x0;
 var _0x4d74cb = _0x5a46[_0x2d8f05];
 return _0x4d74cb;
};
function verify() {
 checkpass = document[_0x4b5b('0x0')]('pass')[_0x4b5b('0x1')];
 split = 0x4;
 if (checkpass[_0x4b5b('0x2')](0x0, split * 0x2) == _0x4b5b('0x3')) {
 if (checkpass[_0x4b5b('0x2')](0x7, 0x9) == '{n') {
 if (checkpass[_0x4b5b('0x2')](split * 0x2, split * 0x2 * 0x2) == _0x4b5b('0x4')) {
 if (checkpass[_0x4b5b('0x2')](0x3, 0x6) == 'oCT') {
 if (checkpass[_0x4b5b('0x2')](split * 0x3 * 0x2, split * 0x4 * 0x2) == _0x4b5b('0x5')) {
 if (checkpass['substring'](0x6, 0xb) == 'F{not') {
 if (checkpass[_0x4b5b('0x2')](split * 0x2 * 0x2, split * 0x3 * 0x2) == _0x4b5b('0x6')) {
 if (checkpass[_0x4b5b('0x2')](0xc, 0x10) == _0x4b5b('0x7')) {
 alert(_0x4b5b('0x8'));
 }
 }
 }
 }
 }
 }
 }
 } else {
 alert(_0x4b5b('0x9'));
 }
}

This looks intimidating but it’s just simple mapping and obfustication, and can be easily traced. Preferably if I absolutely had to choose client side verification, I would hashed the correct credentials instead (though it can be traced back albeit not as easily)

dont-use-client-side

Tue, 02 Jun 2026 10:23:16 +0800

Pretty self-explanatory, upon opening the JS script you will be greeted with this: You can literally rebuild the flag from here, in plaintext. This goes to show how client-side validations can be easily broken and you should never rely on them.

Cookies

Thu, 28 May 2026 17:06:16 +0800

Very interesting problem. The cookie is name = <some-integer> and we are tasked to find out which. On the one hand we can manually type each number in. But on the other hand, we can simply apply a for loop directly in the terminal as follow:

for i in {1..50}; do curl -s http://wily-courier.picoctf.net:64059/check -b "name=$i" | grep picoCTF; done

Notice that we use double quotes here instead of single quotes. In Bash, single quotes are “strong quotes” which is taken as literal, that means the cookies sent if we use those will be literally name=$i which is not what we want.

logon

Thu, 28 May 2026 16:35:16 +0800

If you view the site’s Cookies in the developer tool after you’ve logged in as anything other than Joe, you’ll notice there is a peculiar ‘admin’ cookie set to False, simply send a request with ‘admin=True’ then voila we will get the flag.

curl -b 'admin=True' http://fickle-tempest.picoctf.net:50274/flag

picobrowser

Thu, 28 May 2026 16:24:16 +0800

We are immediately slapped in the face with the picobrowser schtick, so the most logical thing to do is to send an HTTP request with the User-Agent as picobrowser. There we will get our flag.

curl -H "User-Agent:picobrowser" http://fickle-tempest.picoctf.net:51879/flag

Note that the -H flag is for general headers.

Scavenger Hunt

Thu, 28 May 2026 16:00:16 +0800

First two parts of the flag can be found on the HTML and CSS source file. The third part can be found on robots.txt. No problems with this.

In robots.txt it mentions that the server the web is running on is Apache, which can be verified by sending a simple HTTP request. This strongly hints at accessing .htaccess file, which is the common Apache config file. It reveals how the backend of a website is structured, internal IP addresses, and convieniently our fourth part of the flag.

Secrets

Tue, 19 May 2026 16:01:16 +0800

When first viewed page source, notice that the header references a hidden /secret/assets folder where index.css resides. But going to /secret/assets will greet us with a 301. So the next logical thing to do is to access /secret, which we can. The following code snippet will apply for all subsequent folder hops, with simple appending.

curl 'http://saturn.picoctf.net:63724/secret/.' -v

Upon viewing the page source, we are once again hinted at the existence of a hidden /hidden subfolder.

GET aHEAD

Tue, 19 May 2026 15:18:16 +0800

This challenge is practically begging you to send a HEAD request to the server. HEAD is essentially the same as GET but the server only sends back the HTTP Headers and drops the body (the HTML, image, video, etc).

curl -I 'http://wily-courier.picoctf.net:56339/index.php'

Our flag will appear in the HTTP header.

Forbidden Paths

Tue, 19 May 2026 15:02:16 +0800

I struggled quite a bit at first, but notice that they forbid absolute file path. Meaning we can just use the relative file path to travel up the directories and get our flag.

Simply input ../../../../flag.txt into the form box to get the flag. Quite nice.

Roboto Sans

Tue, 19 May 2026 14:22:16 +0800

Upon opening up robots.txt, we are greeted with this:

User-agent *
Disallow: /cgi-bin/
Think you have seen your flag or want to keep looking.

ZmxhZzEudHh0;anMvbXlmaW
anMvbXlmaWxlLnR4dA==
svssshjweuiwl;oiho.bsvdaslejg
Disallow: /wp-admin/

Access either /cgi-bin or /wp-admin will result in 404, so clearly it isn’t the way.

Instead, the 6th line anMvbXlmaWxlLnR4dA== has two trailing equal signs, hinting at base64 encoding.

echo "SGVsbG8gV29ybGQ=" | base64 -d

Upon decoding that line, we will get js/myfile.txt which is where our flag is. Quite fun problem.

where are the robots

Tue, 19 May 2026 14:15:16 +0800

At first I kept focusing on the main site without noticing that the name of the problem hints at the robots.txt file itself.

Simply access robots.txt and it will show you this:

User-agent: *
Disallow: /cc6b1.html

Go to the disallowed path and you’ll get the flag

rotation

Mon, 04 May 2026 21:50:16 +0800

First, calculate the shift amount. Then for each alphabetical character in the ciphertext, subtract that shift amount with the current character, rotate back to z/Z if went overboard

cipher = "xqkwKBN{z0bib1wv_l3kzgxb3l_555957n3}"
diff = ord(cipher[0]) - ord('p')
plain = ""

for c in cipher:
 ch = ord(c) - diff
 
 if c.islower():
 if chr(ch).islower():
 plain += chr(ch)
 else:
 plain += chr(ch + 26)
 
 elif c.isupper():
 if chr(ch).isupper():
 plain += chr(ch)
 else:
 plain += chr(ch + 26)
 
 else:
 plain += c
 
print(plain)

Note that this Python implemention is not exactly the prettiest in the world. And I struggled quite a bit because I thought digits are also rotated (its not lol)

basic-mod2

Mon, 04 May 2026 21:36:16 +0800

Take each number mod 41 and find its modular inverse using Fermat’s little theorem, then map it to the following character set: 1-26 is the alphabet (uppercase), 27-36 are the decimal digits, else an underscore.

cipher = [432, 331, 192, 108, 180, 50, 231, 188, 105, 51, 364, 168, 344, 195, 297, 342, 292, 198, 448, 62, 236, 342, 63]
plain = ""

for n in cipher:
 n = n % 41
 n = pow(n, 41 - 2, 41)
 if 1 <= n <= 26:
 plain += chr(n - 1 + 65)
 elif 27 <= n <= 36:
 plain += chr(n - 27 + 48)
 else:
 plain += '_'
 
print(plain)

basic-mod1

Mon, 04 May 2026 21:25:16 +0800

Take each number mod 37 and map it to the following character set: 0-25 is the alphabet (uppercase), 26-35 are the decimal digits, and 36 is an underscore.

encoded = [350, 63, 353, 198, 114, 369, 346, 184, 202, 322, 94, 235, 114, 110, 185, 188, 225, 212, 366, 374, 261, 213]
plain = ""

for n in encoded:
 n = n % 37
 if 0 <= n <= 25:
 plain += chr(n + 65)
 elif 26 <= n <= 35:
 plain += chr(n - 26 + 48)
 else:
 plain += '_'
 
print(plain)

Cryptography

Mon, 04 May 2026 21:23:16 +0800