Skip to content

Latest commit

 

History

History
16 lines (13 loc) · 581 Bytes

README.md

File metadata and controls

16 lines (13 loc) · 581 Bytes
Raw

Broken challenge response handshake

  • user has to authenticate to get the flag
  • user does not have the shared secret
  • broken: first the backend authenticates for a user supplied challenge

Deployment

docker build --rm -t challenge-response .
docker run --name cr1 -p 2023:2023 challenge-response

Exploit

python exploit.py

Solution

  1. create connection 1: send garbage challenge (we don't neet it)
  2. get challenge to authenticate to get the flag (connection 1)
  3. create connection 2 and ask the backend for the valid response for the challenge we have to solve