pentest-ctf

pentest-ctf

CTF (Capture the Flag) challenge solving. Authorization: CTF platforms authorize attacks on their own platforms (in HackTheBox, THM, etc. ROEs). Use against any other platform counts as a violation.

Triggers

• "HackTheBox machine"
• "TryHackMe room"
• "PicoCTF challenge"
• "pwn challenge"
• "reverse engineering challenge"
• "crypto challenge"
• "stego challenge"

Category-Based Approach

Web

# Typical flag: HTB{...}, picoCTF{...}, flag.txt
# Approach:
1. Nmap full TCP (-p-)
2. HTTP banner + tech detect (whatweb)
3. Content discovery (ffuf / gobuster)
4. Parameter discovery (paramspider, Arjun)
5. SQL injection (sqlmap test but LOUD)
6. SSRF / XXE / SSTI / template injection
7. Source code reveal (.git, .env, backup files)

Pwn (Binary Exploitation)

# Typical: ELF binary + nc <host> <port>
# Approach:
1. `file ./challenge` + checksec
2. Strings + disassemble the main function (Ghidra)
3. Detect the vulnerability class:
   - Buffer overflow (stack)
   - Format string
   - Use-after-free
   - Heap overflow / off-by-one
4. ROP gadget search (ROPgadget / rp++)
5. Write the exploit (pwntools)
6. Local test -> remote

# Pwntools template
from pwn import *
context.arch = 'amd64'
context.log_level = 'debug'

# Local vs remote
local = True
if local:
    p = process('./challenge')
else:
    p = remote('host', port)

# Exploit
payload = b'A'*40 + p64(0xdeadbeef)
p.sendline(payload)
p.interactive()

Reverse Engineering

# Approach:
1. `file ./binary`
2. Strings (ascii + utf16)
3. Ghidra / IDA Free / Cutter
4. Anti-debug bypass (gdb scripts)
5. Decompile + analyze the main algorithm
6. Trace it to produce the output flag

# Standart RE tools
ghidra ./binary
r2 -A ./binary                   # radare2
gdb-peda ./binary                # gdb + PEDA / pwndbg
strace -f ./binary               # syscall trace
ltrace ./binary                  # library call trace

Crypto

# Common attack categories:
# - RSA: small e, common factor, common modulus
# - ECC: weak curve, invalid curve attack
# - AES: ECB pattern, CBC bit flipping, padding oracle
# - Stream: key reuse XOR
# - Hash: length extension, collision

# RSA small e
from Crypto.Util.number import long_to_bytes
import gmpy2
c, e, n = ..., 3, ...
m, exact = gmpy2.iroot(c, e)
if exact: print(long_to_bytes(int(m)))

# XOR cribdrag
from pwn import xor
plaintext_known = b'flag{'
c1, c2 = ..., ...
# c1 XOR c2 = m1 XOR m2 — crib drag with the known plaintext