web.md

TJCTF 2023 - Web Challenges

#1: hi

Description/Sources

hi

• The link directs us to the following website
  
  
  

• Inspecting the website, we can see that the flag is hidden under a canvas
  
  
  

• We can remove the line above the flag image to reveal the flag
  
  
  

Flag

tjctf{pretty_canvas_577f7045}

#2: swill-squill

Description/Sources

Instancer

• The Instancer directs us to the following website
  
  
  

• From app.py in the server folder

c = conn.cursor()

string = "SELECT description FROM notes WHERE owner == '" + name + "';"
c.execute(string)

• We can perform an SQL injection whereby if we put ' OR 1=1; -- in the Name field, the SQL command above will become "SELECT description FROM notes WHERE owner == '' OR 1=1; --';". The -- turns everything behind it on that line into a comment, and since '' OR 1=1 always return True, the website will display everything from every owner in the database.
  
• Since admin is the first entry in the database, the first few lines displayed will contail the flag.

Flag

tjctf{swill_sql_1y1029345029374}