n00bCTF 2016 Write up - BATMAN

Description : Link here takes you to Batman shop. Can you take the flag from batman? Submit sha-256 of the flag obtained.

Point : 30

First there are several link that you can click on the left hand side. What do we want now is the flag.

When click the "Flag" link, it just show :

 We don't give flag to outsiders. We are Batman


After click and click all the link, I dont know how to get the flag. The hint here we must be a batman to get the flag.

I get the idea to change the parameter in the link to other value that are not related with the link given.

For example, there are eight links in that page from http://hack.bckdr.in/BATMAN/?st=1 until http://hack.bckdr.in/BATMAN/?st=8

So I just change the value to 9 like this :

http://hack.bckdr.in/BATMAN/?st=9
I got this ?


We knew that the product doesn't exist, but yeah! It doesn't pop up any error, so we just need to bruteforce the value. And luckily when I change the value to 10.

http://hack.bckdr.in/BATMAN/?st=10
 Voila!


Just translate the flag to sha-256 and get the 30 points!

Share this

Related Posts

Previous
Next Post »