CTF 2.0

• links
• grep -rni "flag{.*}"
• grep -r "flag{,*}"
• Hints
• Steganography
  • Steganography audio
• Web
• Cryptography
• Forensics
• Reverse Engineering
• OSINT
• PWD

Steganography

• Full stego
• file image.png
• strings image.png
• steghide --extract -sf image.jpg -p <password>
• StegCracker
  • stegcracker imag.png /usr/share/wordlists/rockyou.txt
• stegoveritas.py stego.jpg
• convert flag.png -auto-level output.png
• pngcheck image.png
• foremost image.png ---> to recover the original image
• sudo apt install libimage-exiftool-perl -y
  • exiftool image.png
• exiv2 file : shows the metadata of the given file
• eog image.png
• xxd image.png
  • if you see IEND chunk in exiftool use this command.
• find | xargs cat | grep "find" //if you have lot of text file then you this
  • grep -rni "flag{.*}"
• Download the stegsolve.jar in any GitHub
  • java -jar stegsolve.jar
  • make sure that you give the permission.
• ZXing Decoder
  • If the image is QR code image
• sudo apt install ruby
  • sudo gem install zsteg
  • zsteg image.png or zsteg -a image.png or zsteg -E image.png
  • only for png image.
• binwalk -e image.png
  • binwalk --dd = ".*" image.png
• outguess -r image.png flag.txt
  • for the LSB.
• For the noice image
  • go to --> online
• one more for the LSB.
  • go to ---> jsteg (clone it!!)
  • open the file
  • run this command go run cmd/jsteg/main.go reveal ~/Desktop/image.jpg
• Unicode
  • zero width space
• stegsonw -C -p "welc0me_t0_zh3r0_ctf" chall.txt
• Use GIMP to work with QR dots
• otfinfo -i font.ttf for file.ttf
• zbarimg image.png to read the qr code
• redacted text (cover with block) in a given pdf
  • pdftotext file.pdf or pdftohtml file.pdf
• suspicious space and tabs in a given text file
  • python script to extract and convert from binary to ASCII and get the flag.
• Fcrackzip this tool bruteforces zip archives
  • fcrackzip -u -D -p wordlist.txt file.zip
• npiet online
  • An online interpreter for piet. piet is an esoteric language , programs in piet are images. read more about piet here
• Comparison (cmp)
  • Useful for comparing a modified file with its original version found online.
  • cmp original.jpg stego.jpg -b -l
• Image Error Level Analyser
• Magic Eye Solver / Viewer

Steganography audio

• Morsecode

• stegolsb

  • If the audio is related to LSB
  • cd Steganography
  • give the permission
  • python3 setup.py install

• Wavsteg

• WavSteg is a python3 tool that can hide data and files in wav files and can also extract data from wav files. You can get it from github

  • python3 WavSteg.py -r -s soundfile -o outputfile : extracts data from a wav sound file and outputs the data into a new file

• stegolsb wavsteg -r -i file.wav -o flag.txt -n 2 -b 1000

• Keypad number sound

  • DTMF button keys to generate tones
  • Detect DTMF Tones

Web

• http://127.0.0.1:808/index.php?page=' and die(system("cat index.php")) or '
  • if you want to read the index.php use this payload in the url " ' and die(system("cat index.php")) or ' "
• curl -X POST --data hash=2196812e91c29df34f5e217cfd639881 "http://example.com:8080/admin.php"
  • you use this if you found hash in the sorce page
• wget -m http://example.com:8080/
  • here it will download the all the file in the website
  • grep -R "CTF{.*}" use this commond after download the all files
• gobuster dir -k -u http://127.0.0.1/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -x txt,cnf,conf
• gobuster dir -w /usr/share/wordlists/dirb/common.txt -x .html,.php -u http://192.168.51.11/

Cryptography

1. This is Hill Cipher, see how it works or use an online decoder

   • Reference

2. Replace small letters with A, capital letters with B

   • BA BAAB AAABABAAAAABB AAA BBBBAA BBABAAA BA ABBABAAAB AABAAAA AB AAAAAA AABABB BBAABBABBAABA
   • bacon-cipher

Forensics

• outer space audio
  • sudo python3 setup.py install
  • sstv -d file.wav -o result.png
  • if the hit is related about SSTV(slow scan TV)
• strings flag.zip | grep -i cit | sort | uniq -u
  • Given zip file was numerous directories with a flag.txt
• A simple script to converts the RGB values of each pixel into characters
  • Script

Reverse Engineering

• ltrace ./filename
  • The file is executable_file so we use ./filename
• strace ./filename
• ghidra
  • Download the zip file from the above linehidra_11.0.3_PUBLIC_20240410.zip
• objbump -d executablefile it will show the assembly code of the file
• apktool d --advanced candorid.apk
  • grep -rni "flag{.*}"

OSINT

• To find the user in the internet use this tool called sherlock

PWD