CTFs | THCon23 | Hackbook

Hackbook

This chall is split in 4 parts (Hackbook#1 to Hackbook#4). There is a Steganography chall that is called Hackbook Bonus #2 you can find it here

Hackbook #1

Here is the challenge formulation:

When going to the website, we can create an account on it. When we do so, we can go to the Help Center section and we can see the following:

As we can see, we can access post information, and also user information. We are looking for the account of Léa and as we can see it’s the account with the ID=1:

Looking at her profile, we can see that she loves her cat grisouille and that she lives in Toulouse,31. We can create a wordlist with the following information to try cracking the hash found via the API of the website and…Voilà:

But to connect, we need her email address and we only have her pseudo… But looking at the images where she is tagged we can find her email. We suppose that she has a Gmail account because it begins with a g and most people have a Gmail account for personal business:

So now we have the combo lea.leroux.gribouille@gmail.com : gribouille31. As you can see, we can connect to the account:

And we find the flag in the Notes section:

Hackbook Bonus #1

Here is the formulation for the first bonus challenge:

So we search in the source code of every page and…On the Help Center page:

Hackbook #2

Here is the formulation for the second challenge:

As we can see, Kevin is the user with ID=2:

We can find in the list of his posts, the URL of his blog:

Where we can find his email kevin@keke.com:

The website doesn’t look like there is much… But he talks about some login page… Does he have one ?:

Let’s head to the /login page:

We can see a basic login page. First thing that comes to my mind is SQLi. So y try the payload admin' or True # and …:

We head back to the main page and find his password:

We connect with the credentials kevin@keke.com : lock_and_key:

And we get the flag:

Hackbook #3

Here is the formulation for the third challenge:

Our target (Alexia our “girlfriend”) is the user with the ID=3 and we find her email directly:

Looking at the blog information, we can see that Kevin is watching Netflix on the account of Alexia:

And we can see that Alexia uses the same password on different platforms:

So if we can have the password of the Netflix account, we may be able to connect as Alexia. And we can kindly ask her when connected as Kevin:

And now, using alexia@girlfriend.com : j@dOreN3tfl1x to connect to the hackbook:

And the flag is in the notes: