ASC Wargames Qualifications 2022 Web Challenge Write-up

Hi , My name is Ahmed Magdy :)

I participated last year, but I will not participate this year with team because I was busy preparing some more important things than the competition.

I would like to thank all the organizers for this CTF

Arab Security Cyber Wargames

Let’s go solving the web challenge

1- Challenge Name : Warm-Up > Drunken Developer

When i check the source code i find the

Temp Mail in development

Make Mail admin = wars_admin1@vistaemail.com

And send the requested to change your account’s password

token=wefwe-f32f-223-xasd-wqq-875r-cvsa

ASCWG{%Sca21_QS_2!3eSKC&qw9@_warmup}

Flag : ASCWG{%Sca21_QS_2!3eSKC&qw9@_warmup}

2- Challenge Name : Konan

username is admin

This site enter username to send the OTP

we need admin OTP

and any Dir not allow

make brute forcing OTP but it is not work and not allowed

The first time I see CTF it is forbidden :)

دقيقة يا جماعة نفهم😂😂ا

errors and reason invalid OTP

ِAny OTP i send it >> Errors and reason invalid OTP

Change response

Change response from True to False

Errors False

ASCWG{@$CASQWsd#w8_3232_xasw_xas@1da_easy}

Flag : ASCWG{@$CASQWsd#w8_3232_xasw_xas@1da_easy}

3- Challenge Name : Evil Volunteer

Evil Volunteer

After register and login

fill upload

After many attempts to upload a file php i Failed

I will upload normally photo

A 3D photo made by Mohamed Magdy my brother

When delete handle we can see the photo with base64

I will inject JS code in file

Ahmed Hacker Pro

Stored XSS

I will inject PHP code in file to get RCE

<?php system($_GET[‘cmd’]); ?>

when cat flag.php

ASCWG{f$@wef#23_4_as_KR_qwq21_21aasd_medium_1}

Flag : ASCWG{f$@wef#23_4_as_KR_qwq21_21aasd_medium_1}

4- Challenge Name : Doctor X

Doctor X

After register and login

I find local storage data

UserID : 656

i will edit it from UserID : 656 to UserID : 1 to login as admin

woo dashboard is change to dashboard admin

woo dashboard is change to dashboard admin

we need admin pass

all info

when login with username and pass it is normal user not admin i need admin with id 1 not 11

after add ( } ) in request to show any error

NoSQL

I need damp all user info

ASCWG{@#921$s_24sd_ASD_544ASX_medium_2}

Flag : ASCWG{@#921$s_24sd_ASD_544ASX_medium_2}

End the web challenge…… I solve it :)

k3der karweta 😂♥️

Think you for your time :)

I would like to thank all the organizers for this CTF again:)

And finally, Thank you to read this write-up :)

Contact me if you want : Facebook or LinkedIn