[Retired] API Security and JWT CTF: [Oct 23-27]

This CTF contest has concluded. The solution PDF manual is provided above for your reference.

Welcome to our Weekly CTF Contest!

CTF Description:

As a developer, rate-limiting and user-input sanitization are the two most important controls that must be present in an API! It is also a good idea to keep the libraries updated, especially when there are security issues with the older versions!

With these mechanisms in place, a majority of the API's become secure!

In this CTF contest, you get access to a shopping web application. Break into the account of an authorized user and try to leverage issues with the backend API to exfiltrate data from the target machine and get adequate information to break into the target machine. Also leverage the backend API to escalate to root by some input sanitization bug. After getting into the target machine, interact with the API running on the other machine accessible from the target machine’s network. Bypass token checks, retrieve the admin token, leverage the tokens to exfiltrate data, and try to get the flag from that machine by leveraging the database!

Objective:

Collect all ten flags.

Level:

Hard.

Instructions:

• Select the Server closest to you and click on RUN to start the lab (takes approximately 25s).

• Click on LAB LINK to get a Kali GUI instance.

• This lab is dedicated to you! No other users are on this network

• The first target web application and the backend API should be available on the machine having IP address 192.X.Y.3.

• The second target machine should be accessible from the machine where the first target web application is running. It would have the IP address 192.A.B.3. Run "ip a" to know the values of A and B.

• Do not attack the gateway located at IP address 192.X.Y.1

• Collect the 10 flags stored in the different places: FLAG1, FLAG2, FLAG3, /root/FLAG4 (on the first target machine containing the webapp), FLAG5, FLAG6, FLAG7, FLAG8, FLAG9, FLAG10

  
  

Rules:

• Capture and verify 10 flags - FLAG1, FLAG2, FLAG3, FLAG4, FLAG5, FLAG6, FLAG7, FLAG8, FLAG9, FLAG10.

• Once you verify the flags, email attackdefense@pentesteracademy.com with a short report on the process and the email you used to register on this website.

• Reply to our Twitter or LinkedIn posts to let us know you've submitted your report. 

• This CTF contest will start on 0000hrs Oct 23, 2020 ET and end on 2359hrs Oct 27, 2020 ET.

• The first 3 correct submissions will get a 30-day subscription to PentesterAcademy.

• An additional 3 correct submissions will also get a 30-day subscription to PentesterAcademy. These will be picked randomly from the remaining correct submissions coming in till 2359hrs Oct 27, 2020 ET. 

• Winners will be contacted on Oct 28-29, 2020.

• All decisions from our team will be final.