PicoCTF 2017 – Master Challenge – Lazy Dev

Another day, another challenge.

Today’s blog post, we’re going to solve the master challenge of level one of the PicoCTF challenge called, “Lazy Dev”.

Let’s get started.

Clicking on the challenge we see the following:


Hmm… we need to log into the application even though the login logic has not been implemented.

Clicking on the link we see:


Going back to the challenge and look at the hints we see:


OK. The hints state maybe we need to interact with JavaScript.

Going back to the website and doing a right click, view page source we see:


We see there’s a input box for password that is calling the process_password function. Where is this function coming from? Maybe it’s coming from line 10 that has a javascript source file named client.

Clicking this file (client.js) we see:


Looking at the first function validate(pword) we notice it’s not implemented. It’s always going to return false, with the comment – todo: implement me

Going back to the hints we remember that we need to access the JavaScript directly. We can do this by viewing the developers tools.

Let’s view the development tools by pressing F12 on our keyboard, and then pressing F5 to refresh the page.

When we do this, we see:


Clicking on the sources we see the files that were loaded from the web page.


Looking at line 26 we see that we’re calling the make_ajax_req. Inside this function we see in line 15 checks the state change. If the state changes we’ll get the password.

How can we change the state when the login has not been implemented?

Let’s see if we can call the make_ajax_req function directly from the console.

First, let’s add a break point to line 15 in the make_ajax_req function.

Next we’ll add the following to the console:


Pressing Enter we go to the break point.

We’re accessing the JavaScript directly!

Stepping through the code multiple time we noticed that we execute line 15 of the make_ajax_req function.

Once it’s done we see there’s text that’s inputted inside the browser.

Looking at the browser we see:


We have the flag!!

Entering the flag we’ve acquired 50 points, and unlocked level 2!


PicoCTF 2017 – What Is Web

Another day, another challenge.

In today’s blog post we are solving the challenge, “What Is Web” from the PicoCTF challenge.

Let’s start!

Clicking on the challenge we see:


OK, so we need to find out how to use HTML.

Looking at the hints we see:

Clicking on the website we see:

PicoCTF_What_Is_Web_3Doing a right click, view source we see:


At the bottom of the screen in the green letters (which are comments that are not displayed in the browser) show that we have the first part of the flag.

Now we need to find the second and third part of the flag.

Looking back at the page source we see two different files that are referenced: hacker.css and script.js

Let’s look at hacker.css first and see what’s there.

Going to that file we see the second part of the flag at the top of the browser:


Now let’s look at the script.js file and see if we can find the final part of the flag…

Going to the script.js file we see:


We now have the three parts of the flag!

Combining the parts together and submitting the flag, we’ve acquired 20 points!

PicoCTF 2017 – Internet Kitties

Another day, another challenge…

Today’s blog post we will solve a problem in the PicoCTF challenge.

Let’s start!

After logging into the CTF, and clicking on the “Internet Kitties” challenge we’re presented with the following:


Reading the description, really doesn’t give a lot of clues. Clicking on the hints tab we see:


OK, so we need to use the netcat command. On the right side of the panel we’re presented with a command prompt. After logging in we have the following:


Executing the help command (nc -h) in the command prompt we see:

The first line we see is how to connect to a server. Maybe we can use this to solve the challenge?

Looking at the challenge again we have the host name and port.

Let’s try it and see what we get:


We found the flag! Entering the flag we scored 10 points!