IMPORTANT:AttackDefense Labs is included with a Pentester Academy subscription! Upgrade Now to access over 1800+ Labs.
Already a Pentester Academy student? Your access will continue uninterrupted. Please use the same Google account to login here.
Not a Pentester Academy student? Try our Free Communitiy Labs
[Retired] API Security CTF: [Nov 20-24]
weekly-ctf-all | Level: Easy | Total Lab Runs: 0 | Premium Lab |
This CTF contest has concluded. The solution PDF manual can be downloaded from above.
Welcome to our Weekly CTF Contest!
CTF Description:
Webapps are an inevitable part of our lives. Almost every day we interact with applications either for buying stuff or for work-related purposes.
REST API is the new paradigm to model the applications for the web and offers greater flexibility. Due to this, it’s preferred over conventional ways of designing web applications. However, better doesn't mean secure!
REST APIs come with their own set of challenges. When the developers are not security-centric, things can definitely go wrong!
This CTF is focused on API Security. Explore how a benign Image Converter web apps' features can be leveraged to compromise the target server hosting the application. Also explore how the internal service used to monitor instance health can be compromised due to weak authentication schemes and improper input sanitization, leading to the compromise of a database and eventually the whole system!
Objective:
Collect all ten flags.
Level:
Hard.
Instructions:
Click on RUN to start the lab (takes approximately 25s).
Interact with the Image Converter webapp and the related APIs and recover ten flags.
Apart from FLAG5 and FLAG8, the flags are named as FLAG1, FLAG2, FLAG3, FLAG4, FLAG6, FLAG7, FLAG9, FLAG10
FLAG5 is the password of webapp’s admin user
FLAG8 is the password of root user of MySQL database
Rules:
Capture and verify 10 flags - FLAG1, FLAG2, FLAG3, FLAG4, FLAG5 (Webapp's admin user password), FLAG6, FLAG7, FLAG8 (MySQL root user's password), FLAG9, FLAG10
Once you verify the flags, email attackdefense@pentesteracademy.com with a short report on the process and the email you used to register on this website.
Reply to our Twitter post to let us know you've submitted your report.
This CTF contest will start on 0000hrs Nov 20, 2020 ET and end on 2359hrs Nov 24, 2020 ET.
First 3 players to capture all the flags get a 1-month subscription + Pentester Academy T-shirt
3 other participants who capture all the flags will be selected randomly to win 1-month subscriptions! These will be picked randomly from the remaining correct submissions coming in upto 2359hrs Nov 24, 2020 ET
Winners will be contacted on Nov 25-26, 2020
All decisions from our team will be final.
| Verify: | ||
|---|---|---|
| 1. | FLAG1 |
|
| 2. | FLAG2 |
|
| 3. | FLAG3 |
|
| 4. | FLAG4 |
|
| 5. | FLAG5 (Webapp's admin user password) |
|
| 6. | FLAG6 |
|
| 7. | FLAG7 |
|
| 8. | FLAG8 (MySQL root user's password) |
|
| 9. | FLAG9 |
|
| 10. | FLAG10 |
|
The following activities are strictly prohibited on this website unless otherwise explicitly stated as allowed in the mission statement:
- Using automated scanners
- Using brute force attacks
- Denial of Service attacks
- Attacking other student machines in challenges where you might achieve a shell on the vulnerable system
- Attacking the lab infrastructure
Users violating the above will be either temporarily or permanently banned from the website.
If you are unsure about an activity, then please contact support to confirm that it is allowed on our website.
Technical Support for this Lab:
There is a reason we provide unlimited lab time: you can take as much time as you need to solve a lab. However, we realize that sometimes hints might be necessary to keep you motivated!
We currently provide technical support limited to:
- Giving hints for a lab exercise
- In rare circumstances, if you have totally given up (NO!!!) then tell you how to solve it. This will be limited to sharing the solution video or lab report
- A lab exercise fails to load or has errors in it
If you need technical support, please email attackdefense@pentesteracademy.com clearly mention the name and link of the lab exercise and other essential details. The more descriptive you are, the faster we can help you. We will get back to you within 24 hours or less.
For adminitrative queries, billing, enterprise accounts etc. please email feedback@binarysecuritysolutions.com