2018::RealWorldCTF::Qual

CTF RealWorldCTF Web

Word count: 426Reading time: 2 min

 2018/07/30

RealWorld CTF is very interesting and that is the hardest check-in challenge I’ve ever saw.

This challenge gave nothing, but just one line

This platform is under protection. DO NOT hack it.

Trying not to hack the web, but I can’t find anything.
I did find something interesting, like this one:

It seems to use WebSocket to get some information then render it on template view.
So, let’s change the hash-like string on url.

When url is https://realworldctf.com/contest/5

When url is https://realworldctf.com/contest/5b5bc8c532a7ca004d2d0f64 (Make the length of hash-like string consist with origin)

Did you say Database?
https://realworldctf.com/contest/' or '1'='1' --

My teamate kaibro told me that chaitin has sqlchop product…. ohh…. advertisement… got it
It took me half day to find the flag

Dot Free

There are some js functoin on web page:

function lls(src) {
    var el = document.createElement('script');
    if (el) {
        el.setAttribute('type', 'text/javascript');
        el.src = src;
        document.body.appendChild(el);
    }
};

function lce(doc, def, parent) {
// ...
};
window.addEventListener('message', function (e) {
    if (e.data.iframe) {
        if (e.data.iframe && e.data.iframe.value.indexOf('.') == -1 && e.data.iframe.value.indexOf("//") == -1 && e.data.iframe.value.indexOf("。") == -1 && e.data.iframe.value && typeof(e.data.iframe != 'object')) {
            if (e.data.iframe.type == "iframe") {
                lce(doc, ['iframe', 'width', '0', 'height', '0', 'src', e.data.iframe.value], parent);
            } else {
                lls(e.data.iframe.value)
            }
        }
    }
}, false);
window.onload = function (ev) {
    postMessage(JSON.parse(decodeURIComponent(location.search.substr(1))), '*')
}