Bypassing Basic PHP WAF to Read Files - "para-code" Web Challenge [DefCamp CTF 2022]
Video walkthrough for the "para-code" web challenge from the @DefCampRO Capture The Flag (D-CTF) competition 2021/2022. In this challenge we have a PHP script that will execute our commands with shell_exec but uses strpos() to blacklist many 2-char strings and strlen() to ensure our commands are less than 5 chars. We must find a way to read the flag.php file using only 4 characters, which aren't blacklisted by the basic WAF. Write-ups/tutorials aimed at beginners - Hope you enjoy 🙂 #DefCamp #DCTF #CTF #Pentesting #OffSec
↢Social Media↣
Twitter: / _cryptocat
GitHub: https://github.com/Crypto-Cat
HackTheBox: https://app.hackthebox.eu/profile/11897
LinkedIn: / cryptocat
Reddit: / _cryptocat23
YouTube: / cryptocat23
Twitch: / cryptocat23
↢D-CTF↣
https://dctf21.cyberedu.ro
/ defcampro
/ discord
https://ctftime.org/event/1560
↢Resources↣
Ghidra: https://ghidra-sre.org/CheatSheet.html
Volatility: https://github.com/volatilityfoundati...
PwnTools: https://github.com/Gallopsled/pwntool...
CyberChef: https://gchq.github.io/CyberChef
DCode: https://www.dcode.fr/en
HackTricks: https://book.hacktricks.xyz/linux-uni...
CTF Tools: https://github.com/apsdehal/awesome-ctf
Forensics: https://cugu.github.io/awesome-forensics
Decompile Code: https://www.decompiler.com
Run Code: https://tio.run
↢Chapters↣
Start: 0:00
Review PHP source: 0:25
Bypassing blacklisted chars: 1:40
Read file with 4 chars: 4:52
Brute-Force solution (burp): 7:24
End: 9:33