Information Gathering
web1
Viewing page source code reveals the flag. Right-click context menu or Ctrl+U keyboard shortcut provides access.
web2
Direct browser DevTools access may be restricted. Alternative approaches include:
- Prefixing URL with view-source:
- Using Ctrl+U keyboard shortcut
- Opening DevTools via Ctrl+Shift+I
- Intercepting network responses to examine flag in headers
web3
Network inspection in DevTools reveals flag embedded in HTTP response headers. Capture the request and examine header fields for the flag.
web4
Sensitive paths often documented in robots.txt for automated crawlers
Check the site's robots.txt file for disallowed paths that might contain administrative interfaces or sensitive endpoints.
web5
Initial probe of index.php returns no useful output. Attempting index.phps triggers download of the source file. This technique exploits source code disclosure through alternate PHP extensions.
phps file exposure
web6
Standard archive naming conventions include www.zip, backup.zip, website.zip. Download the archive from the suspected path and examine contents.
Archive contents typically include both visible files and hidden directories. Text files in the archive may contain placeholders, but actual sensitive data often resides in system directories referenced by PHP files.
Open PHP files in the archive and follow path references to locate the correct flag file outside the compromised archive.
web7
.git directories enable:
- Team collaboration workflows
- Version control tracking
Hidden directories prefixed with dots may not appear in standard directory listings. Developers occasionally deploy these to production servers unintentionally, resulting in repository exposure.
Access the root .git directory directly to retrieve commit history and file contents.
Version control information leakage
web8
.svn files serve version control purposes similar to git. Access methodology mirrors web7 approach.
web9
Testing index.php yields no results. Exploring index.php.swp (swap file) triggers download. These recovery files preserve unsaved edits and often remain on production systems.
Open the swap file to extract embedded flag data.
web10
Client-side storage examination via browser DevTools reveals cookie values. The provided cookie contains Base64-encoded flag data.
Decode the cookie value using URL decoding or Base64 decoding to retrieve the flag.
web11
DNS record lookup for the target domain. Query TXT records of ctfshow.com through any DNS lookup service to extract published flag.
web12
Standard reconnaissance includes probing /admin endpoint. Authentication interface appears but standard credentials fail.
Educational institution websites frequently maintain multiple administrative interfaces. Passwords might reuse information from public institutional pages.
web13
Technical documentation often contains embedded administrative information. Inspect the website footer where supplementary resources are listed.
Locate an unusual lowercase entry in the document section—appears different from surrounding capitalized items and functions as a hyperlink.
The linked PDF contains backend administrative credentials and interface URLs. Use these credentials to access the protected panel and retrieve the flag.
web14
Source code analysis via Ctrl+U reveals reference to editor functionality.
Search within source for the editor path. Navigate to /editor directory on the target domain. File upload interfaces commonly embed absolute paths from web server document root.
The attached file browser exposes server filesystem. Navigate to var/www/html directory visible in the file tree.
Directory named "nothinghere" contains fl000g.txt. Construct the final path using the editor attachment prefix plus remaining filesystem path.
web15
Standard reconnaissance includes attempting /admin access. Website footer contains a QQ email address—record this information.
Attempt authentication with admin username and the QQ email as password. Standard reset functionality exists with security questions.
Password reset security question references location. Query the QQ number's profile information to determine regional answer. Complete password reset and authenticate with new credentials.
Social engineering challenge
web16
System examination begins with exploring default probe paths like tz.php.
Navigation reveals available diagnostic functions. Testing command execution capability: system function reports supported but command injection fails. Database connectivity test with root 1234 establishes connection without useful output.
PHP environment information accessible through phpinfo parameter. Review the phpinfo output for configuration details and embedded flags.
web17
Flag resides in SQL backup file. Locate backup.sql or similar database dump file in the webroot.
web18
Game-based challenges frequently embed flag information in client-side JavaScript. Examining source code reveals win condition triggers.
JavaScript contains Unicode escape sequences representing: \u4f60\u8d62\u4e86\uff0c\u53bb\u5e7a\u5e7a\u96f6\u70b9\u76ae\u7231\u5403\u76ae\u770b\u770b
Decode using browser console with alert:
alert("\u4f60\u8d62\u4e86\uff0c\u53bb\u5e7a\u5e7a\u96f6\u70b9\u76ae\u7231\u5403\u76ae\u770b\u770b");
Result displays instruction to visit 110.php. Following this URL delivers the flag.
web19
Client-side validation relies on cryptographic hash comparison. Manipulating request parameters bypasses JavaScript checks.
Intercept authenticated request using Burp Suite or similar proxy. Modify hash parameter to match expected value and forward modified request.
POST request with modified hash parameter
web20
Database files commonly stored in db subdirectory. Microsoft Access databases use .mdb extension.
Probe for db.mdb or data.mdb. Successful download requires database viewer application. Open the database file and navigate to ItemText field containing the flag.
Brute Force
web21
Configure proxy interception and submit test credentials (username: admin, password: 123). Capture the authentication request.
Base64-encoded credentials visible in Authorization header. Decode reveals plaintext admin:123. Prepare for credential stuffing attack.
Configure intruder module: prepend admin: prefix and apply Base64 encoding to payload. Set Grep-match filter for ctfshow in responses. Launch attack and examine results.
HTTP 200 response indicates successful authentication and contains the flag.
web22
Subdomain enumeration service reveals multiple entries for ctf.show domain. Parse results to identify unusual subdomains.
Short subdomains warrant investigation. Access vip.ctf.show and hover browser tab to reveal flag in tooltip.
web23
Requires dynamic analysis approach—direct static review insufficient.
web24
Code review reveals seeded random number generator:
mt_srand(372619038);
Predictable random values result from static seed. Exploit the predictability to generate valid session tokens or other seeded values.
web25
web26
web27
Command Execution
web29
Error suppression via error_reporting(0) prevents verbose feedback. Execute phpinfo() to retrieve PHP version and configuration details.
Note: PHP code execution requires semicolon termination.
File Inclusion
web78
PHP wrapper exploitation enables arbitrary file access. Utilize built-in wrapper functions.
Send request with appropriate wrapper to extract flag. Decode returned Base64-encoded output to retrieve flag contents.
PHP Features
web89
Input validation requires non-numeric characters. The intval function demands positive integer input.
Numeric string bypass using array input satisfies validation requirements. Submit array parameter to circumvent type checking and extract flag.