PicoCTF - Who are you?

22 Sep 2022

Challenge

PicoCTF 2021 / Web Exploitation

Let me in. Let me iiiiiiinnnnnnnnnnnnnnnnnnnn
http://mercury.picoctf.net:52362/

Note that everyone ‘s port and flag are different!

Visit this site, it says: Only people who use the official PicoBrowser are allowed on this site! So I use ThunderClient to request website and change User-Agent in the header to PicoBrowser.
It says: I don’t trust users visiting from another site. So we can add the key of Referer with the value http://mercury.picoctf.net:52362/ to the header and request website again.
It says: Sorry, this site only worked in 2018. So we can add the key of Date with the value 1 Jan 2018 to the header and request website again.
It says: I don’t trust users who can be tracked. So we can add the key of DNT which means do not track with the value 1 to the header and request website again.
It says: This website is only for people from Sweden. So we can add the key of X-Forwarded-For, which can change the originating IP, with the value random Sweden IP address to the header and request website again.
It says: You’re in Sweden but you don’t speak Swedish? So we can add the key of Accept-Language with the value sv to the header and request website again. Then we can get the flag! ٩(^ᴗ^)۶
Header should be like :

22 Sep 2022

PicoCTF 2022 / Web Exploitation / sql

Can you login to this website?

Launch instance.
Login with random username and password. I use admin as username and xx as password.
Now we know the SQL query command, we can use SQL Injection to exploit it.
Use OR 1=1--' as username and password to login again.
The flag is hidden. So inspect elements to find it.
Here’s flag: picoCTF{L00k5_l1k3_y0u_solv3d_it_9b0a4e21} ٩(^ᴗ^)۶

22 Sep 2022

PicoCTF 2022 / Web Exploitation / sql

Connect to this PostgreSQL server and find the flag!

Launch instance.
Open Websell and Log in .
Connect to sql by command psql -h saturn.picoctf.net -p 61408 -U postgres pico and input the password.
Use \dt command to show all table, there is only one table, which is named flags.
Use SELECT * FROM flags; command to check the content of table.
Here’s flag: picoCTF{L3arN_S0m3_5qL_t0d4Y_31fd14c0} ٩(^ᴗ^)۶

22 Sep 2022

PicoCTF 2022 / Web Exploitation

Can you get the flag?
Go to this website and see what you can discover.

Click Continue as guest button, there is a page tell you they don’t have guest service.
Change isAdmin cookie value to 1.
Refresh the page.
Here’s flag: picoCTF{gr4d3_A_c00k13_5d2505be} ٩(^ᴗ^)۶

22 Sep 2022

PicoCTF 2022 / Web Exploitation

The developer of this website mistakenly left an important artifact in the website source, can you find it?
The website is here