Freaks City

Web Security Fundamentals 1. SQL Injection Types and Prevention SQL injection occurs when untrusted data is concatenated into SQL queries without proper validation, allowing attackers to manipulate data base operations. Common types include: character-based, numeric, boolean, error-based, time-based, union-based, stacked queries, wide-byte, and ...

PHP Code Injection Root Cause Inadequate input validation combined with the use of dangerous PHP functions like eval() and assert() allows attackers to inject arbitrary code. A successful exploit can lead to full control over the web application and potentially the underlying server, effectively creating a backdoor. Dangerous Functions eval() e ...

The challenge presents a web application with login and registration functionality. The objective is to retrieve the hidden flag from the database. Initial Exploration Upon accessing the application, we notice registration and login options. Attempting to register with the username "admin" reveals that the account already exists, sugg ...

Directory traversal attacks targeting web framework log files often reveal sensitive internal state or credentials when misconfigured. Many PHP-based CMS platforms store administrative activity logs in predictable directory structures. A common indicator of an unprotected log endpoint is an HTTP 403 Forbidden response combined with visible dire ...

Challenge 1: Magic Methods via Internal ClassesThe regex validation requires both parameters to contain alphabetic characters. The eval function executes the string as PHP code, where new $v1 instantiates a class named by the value of $v1, and ($v2()) invokes the function specified by $v2, passing its return value to the constructor.When an obj ...

What is CSRF? Cross-Site Request Forgery (CSRF) is a web-based attack vector that forces authenticated users to submit unwanted requests to a web application. The attack exploits the trust that a web application has in the user's browser by leveraging active sessions and authentication credentials. When successful, attackers can perform unautho ...

Miscellaneous Who Am I? This challenge requires matching items against a provided list. While straightforward, it demands careful attention to detail as the information is spread across multiple entries. The solution involves cross-referencing each elemant systematically until all correspondences are established. You and Me Blind watermarking ...

Initializing a Superuser Execute the following management command to create an administrative account: python manage.py createsuperuser During the prompt: Username: Required. Email: Optional. Password: Will be stored as a hash. If forgotten, you can manually replace the hash in the database, though resetting via management commands is preferr ...

Target Endpoint and Initialization The target for this analysis is the login portal of a major e-commerce platform. The primary objective is to intercept and decrypt the h5st signature parameter (version 4.7.4) and handle the accompanying CAPTCHA verification. Base64 encoded target: aHR0cHM6Ly9wYXNzcG9ydC5qZC5jb20vbmV3L2xvZ2luLmFzcHg= Request ...

File inclusion is a common programming feature that allows developers to import external code files into their applications. Most programming languages provide built-in functions for this purpose. In PHP, these functions include include(), include_once(), require(), and require_once(). When the included file path is hardcoded, this functionalit ...