5 ms·

> * Challenge 1: https://hackerchess-web.h4ck.ctfcompetition.com/ https://hackerchess-web.h4ck.ctfcompetition.com/ is the goal to hack the chess game or the ad

> * Challenge 1: https://hackerchess-web.h4ck.ctfcompetition.com/ https://hackerchess-web.h4ck.ctfcompetition.com/ is the goal to hack the chess game or the admin panel? I never know how to do these things

bombcar 4y ago
I would guess the goal is to beat a world champion while playing black and get accused of cheating.
- eyegor 4y ago
  - marcofatica 4y ago
    It's a pain in the ass
- gpm 4y ago
  So, I solved this challenge the "intended" way instead of just using an engine. But I'm pretty sure that you could just use an engine for longer than they are. Behind the scenes it appears to just be running stockfish with a timeout of "10" (10s? Didn't check what units, seems faster than 10s so maybe 10ms or something).
  - missblit 4y ago
    It's milliseconds (well except for 0, which stockfish considers an edge case) See: http://wbec-ridderkerk.nl/html/UCIProtocol.html http://wbec-ridderkerk.nl/html/UCIProtocol.html , https://github.com/official-stockfish/Stockfish/issues/3720 https://github.com/official-stockfish/Stockfish/issues/3720 That said I don't think a strong chess engine alone would be enough to pass this puzzle.
  - esjeon 4y ago
    Mind that you're reading a comment written by a dude who got p0wned by Stockfish searching only depth 0. I mean, if you're going down the path of fighting against the AI, you do need an engine.
Gollapalli 4y ago
Well, I got the admin panel to show a completely blank page, instead of an Invalid Login message, so that's progress.
- hayst4ck 4y ago
  You got it to 500, which can be seen via the network dev tools console. (A place you can also right click and "Copy as cURL", to iterate on the command line faster) ^^ A 500 is almost always a good sign when it comes to hacking. Hacking is the art of finding the difference between intended behavior and actual behavior. That is pretty much the definition of a 500.
  - Gollapalli 4y ago
    Well I got the admin menu to show up. Still lost the chess game though (my chess skills need work).
    - hayst4ck 4y ago
      A little bit of python and some stockfish could probably improve your play dramatically! https://github.com/official-stockfish/Stockfish https://github.com/official-stockfish/Stockfish
      - Gollapalli 4y ago
        Lol I thought about it. Thanks for the reply.
    - m4jor 4y ago
      Any tips? I tried brute forcing the login admin panel but no luck yet. What username should I use? I tried all the basic ones and cant get it to display anything besides "Invalid Login!".
      - hayst4ck 4y ago
        It sounds like you've tried [a-zA-Z]* usernames in an attempt to see if you could guess a username. It probably says "Invalid Login!" no matter what is guessed. What do you imagine the code that takes the logins eventually does? It seems likely that the username and password will end up in a query against a database to see if the user is valid and (theoretically) if the hash of the password matches the stored value. What kind of input could you try to see if that behavior is done securely? This is a good site to start learning about security: https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/ Injection will be the most immediately relevant.
hayst4ck 4y ago
The goal is to find the flag, usually somethign unambiguous like "flag{some_lind_of_message}". There are generally no other rules to a CTF other than "don't run a scanner against us"/"don't brute force." Analyzing and listing out ways to interact with the site will show you your surface area, although sometimes the interaction is so opaque you might have to check the "robots.txt" or other well known files. The start button, the difficulty level, making a move, and the admin panel all offer ways to test different inputs to see if you can get unexpected output. What inputs do they accept? What headers do they have? What encodings do they use? Are there any input checks done client side rather than server side? Then it becomes a matter of thinking about what happens with these inputs/outputs. Did it ask for a file name? What if I feed it a file it doesn't expect. Might this input be used for a database query, how could I abuse that? Could my input or the output be marshaled? Could my input be passed to an exec somewhere? Can I find artifacts that tell me what programming languages/servers/libraries are being used? How can I probe for these things? The people who do these for fun several times a month will often make writeups that offer hints of techniques to solve problems when the competition is done. These are some related sites: https://ctftime.org/ https://ctftime.org/ https://ctftime.org/writeups https://ctftime.org/writeups https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/
- devmor 4y ago
  I got to to prompt me for its own moves and fed it some invalid base64 and now it's completely broken unless I clear the session. That's as far as I'm really interested in going, but it was fun to play around.

bombcar 4y ago

I would guess the goal is to beat a world champion while playing black and get accused of cheating.

eyegor 4y ago
- marcofatica 4y ago
  It's a pain in the ass
gpm 4y ago
So, I solved this challenge the "intended" way instead of just using an engine. But I'm pretty sure that you could just use an engine for longer than they are. Behind the scenes it appears to just be running stockfish with a timeout of "10" (10s? Didn't check what units, seems faster than 10s so maybe 10ms or something).
- missblit 4y ago
  It's milliseconds (well except for 0, which stockfish considers an edge case) See: http://wbec-ridderkerk.nl/html/UCIProtocol.html http://wbec-ridderkerk.nl/html/UCIProtocol.html , https://github.com/official-stockfish/Stockfish/issues/3720 https://github.com/official-stockfish/Stockfish/issues/3720 That said I don't think a strong chess engine alone would be enough to pass this puzzle.
- esjeon 4y ago
  Mind that you're reading a comment written by a dude who got p0wned by Stockfish searching only depth 0. I mean, if you're going down the path of fighting against the AI, you do need an engine.

Gollapalli 4y ago

Well, I got the admin panel to show a completely blank page, instead of an Invalid Login message, so that's progress.

hayst4ck 4y ago
You got it to 500, which can be seen via the network dev tools console. (A place you can also right click and "Copy as cURL", to iterate on the command line faster) ^^ A 500 is almost always a good sign when it comes to hacking. Hacking is the art of finding the difference between intended behavior and actual behavior. That is pretty much the definition of a 500.
- Gollapalli 4y ago
  Well I got the admin menu to show up. Still lost the chess game though (my chess skills need work).
  - hayst4ck 4y ago
    A little bit of python and some stockfish could probably improve your play dramatically! https://github.com/official-stockfish/Stockfish https://github.com/official-stockfish/Stockfish
    - Gollapalli 4y ago
      Lol I thought about it. Thanks for the reply.
  - m4jor 4y ago
    Any tips? I tried brute forcing the login admin panel but no luck yet. What username should I use? I tried all the basic ones and cant get it to display anything besides "Invalid Login!".
    - hayst4ck 4y ago
      It sounds like you've tried [a-zA-Z]* usernames in an attempt to see if you could guess a username. It probably says "Invalid Login!" no matter what is guessed. What do you imagine the code that takes the logins eventually does? It seems likely that the username and password will end up in a query against a database to see if the user is valid and (theoretically) if the hash of the password matches the stored value. What kind of input could you try to see if that behavior is done securely? This is a good site to start learning about security: https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/ Injection will be the most immediately relevant.

hayst4ck 4y ago

The goal is to find the flag, usually somethign unambiguous like "flag{some_lind_of_message}". There are generally no other rules to a CTF other than "don't run a scanner against us"/"don't brute force." Analyzing and listing out ways to interact with the site will show you your surface area, although sometimes the interaction is so opaque you might have to check the "robots.txt" or other well known files. The start button, the difficulty level, making a move, and the admin panel all offer ways to test different inputs to see if you can get unexpected output. What inputs do they accept? What headers do they have? What encodings do they use? Are there any input checks done client side rather than server side? Then it becomes a matter of thinking about what happens with these inputs/outputs. Did it ask for a file name? What if I feed it a file it doesn't expect. Might this input be used for a database query, how could I abuse that? Could my input or the output be marshaled? Could my input be passed to an exec somewhere? Can I find artifacts that tell me what programming languages/servers/libraries are being used? How can I probe for these things? The people who do these for fun several times a month will often make writeups that offer hints of techniques to solve problems when the competition is done. These are some related sites: https://ctftime.org/ https://ctftime.org/ https://ctftime.org/writeups https://ctftime.org/writeups https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/

devmor 4y ago
I got to to prompt me for its own moves and fed it some invalid base64 and now it's completely broken unless I clear the session. That's as far as I'm really interested in going, but it was fun to play around.