CloudSEK CTF was a fun and technically enriching challenge set covering scripting automation, web vulnerabilities, Android OSINT, JWT manipulation, and authentication bypass techniques. This write-up documents my approach and methodology for the challenges I solved.
- Nitro
Nitro 100 Ready your scripts! Only automation will beat the clock
and unlock the flag. http://15.206.47.5:9090
Method:
Random string on http://15.206.47.5:9090/task :
Here is the input string: Vr9jz8d13k6K
Things need to don in script:
Reverse the string ,encode with base64, wrap it in the given format
and submit the string.
import requests
import base64
import re
BASE = "http://15.206.47.5:9090"
session = requests.Session()
TOKEN_REGEX = re.compile(r"input string:\s*([A-Za-z0-9+/=]+)")
def extract_token(html):
m = TOKEN_REGEX.search(html)
if not m:
raise ValueError("Token not found")
return m.group(1)
def build_payload(s):
rev = s[::-1]
b64 = base64.b64encode(rev.encode()).decode()
return f"CSK__{b64}__2025"
print("[*] Automation loop started...")
while True:
try:
r_task = session.get(f"{BASE}/task", timeout=3)
token = extract_token(r_task.text)
payload = build_payload(token)
r_submit = session.post(f"{BASE}/submit", data=payload, timeout=3)
print("Token:", token)
print("Response:", r_submit.text.strip())
print("-" * 40)
if "flag" in r_submit.text.lower():
print("FLAG FOUND!")
break
except Exception as e:
print("Error:", e)
Got the flag.
2. Bad Feedback:
Method:The data in feedback form is sent in xml and client side js script is
visible. So I got the idea that this can be vulnerable to xml
injection. I tested it with a simple payload.
Got the flag using this payload.
3. Ticket:
Strike Bank recently discovered unusual activity in their
customer portal. During a routine review of their Android app,
several clues were uncovered. Your mission is to investigate
the information available, explore the associated portal, and
uncover the hidden flag. Everything you need is already out
there! Connect the dots and complete the challenge.
The android package is com.strikebank.netbanking and the
security review was conducted via bevigil.com.
Report can also be viewed by visiting the URL with the
following format: https://bevigil.com/report/<package_name>
Method:
Report: https://bevigil.com/report/com.strikebank.netbanking
Explore the report to get the url of the Vulnerable
website(Strike Bank).
Website — 15.206.47.5.nip.io
Exploring strings we got the jwt secret and default
credentials .
Username — tuhin1729
Password: 123456
After logging with these credentials I got a jwt token assigned
to tuhin1729 user. I replaced the jwt token with a custom
made jwt token. And got the flag.
4.Triangle
The system guards its secrets behind a username, a
password, and three sequential verification steps. Only those
who truly understand how the application works will pass all
three.
Explore carefully. Look for what others overlooked. Break the
Trinity and claim the flag.
http://15.206.47.5:8080
Method:
As i have to bypass this login portal i start with sql injection
but after trying sql injection and roaming around in website
code i see an html comment for Dev Team 2 that to make
changes in google2fa.php file and remove .bak file.
I tried to access http://15.206.47.5:8080/google2fa.php but
didn’t get the file then i tried
http://15.206.47.5:8080/google2fa.php.bak and got the bak
file.
Then I also got the login.php.bak file which has the php
code.
From the login.php.bak file I got the username and password
which is admin and admin.
The google2fa.php.bak has logic that shows how the otp is
generated .
By reviewing the code I tried payload to bypass the otp login
functionality, as it compares the otp which is generated using
google2fa.php.
I tried “00000” as otp but it didn’t work. Then I tried sending blank fields
request that also didn’t work, then I tried “true” as OTP which works and
led us to our flag.
Thanks for reading:)
CloudSEK CTF Writeup was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.