# Web

## Baby Web

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2F1krCfenugw2PyGH96xvf%2Fimage.png?alt=media&#x26;token=1a4ca250-e5ae-42db-8216-41db2ad85837" alt=""><figcaption></figcaption></figure>

This is what we see when visiting the website, It seems that we can have login as any user and the password doesn't seem to matter. Later, I also tried having a password given manually using burp.

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FLTMqR8OS25zJb5jBB0dj%2Fimage.png?alt=media&#x26;token=5a8a68a1-a20d-4e21-89b3-0c0411a77cb0" alt=""><figcaption></figcaption></figure>

When clicked on "Access Admin Area", it tries fetching the `/admin` endpoint and passes that jwt in the Authorization header. Ofcourse it gives `Forbidden` . Now I could guess this is probably something to do with jwt, but before that I'll have a look at the source code and there I found something interesting.&#x20;

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FhCmIOIzQkQ8pZFLcckzo%2Fimage.png?alt=media&#x26;token=fb80fafe-5d92-4ab4-b814-3df47dd7de90" alt=""><figcaption></figcaption></figure>

we do see the `/public-key` endpoint, so we have the public key as well. This could be a jwt confusion attack. I tried loading that in jwt.io and this is what I see.&#x20;

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FObQGn4T2ab8sQHSpeE0W%2Fimage.png?alt=media&#x26;token=ff6e3795-a627-4f51-af0a-92e8f9db12e2" alt=""><figcaption></figcaption></figure>

For the jwt confusion attack, we have to change the algorithm and sign the key with the public key which we have (look at [portswigger labs](https://portswigger.net/web-security/jwt/algorithm-confusion)). I manually get the public key and use it to sign our jwt after changing the role back to `admin`.&#x20;

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FV57NQyLwQKFKnIvEnwTV%2Fimage.png?alt=media&#x26;token=d051cbe9-580b-49a3-86c9-6907e15c500c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FDcjM5xhsJs8rReapJM1a%2Fimage.png?alt=media&#x26;token=7b1de785-6033-43e6-809f-7aba45232f51" alt=""><figcaption></figcaption></figure>

Now we have everything we need, (Note that our key is in base64 so we have to check the checkbox) I can manually use curl to get the flag.

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FZKWfmY3Wx3k09W3Eu72L%2Fimage.png?alt=media&#x26;token=451f81e1-1711-4d3d-9f11-51bf06d6c1d5" alt=""><figcaption></figcaption></figure>

## Get into my cute small planner

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FWKsKAVuZgcrPKt1m8MMl%2Fimage.png?alt=media&#x26;token=87bf031f-78a8-4e97-a396-d9828c1cb9ca" alt=""><figcaption></figcaption></figure>

A Note App, it seems that we can report the notes as well, so probably an admin might take a look at our note, which means that is mostly `XSS`. I was focusing on other challenges and so this was done by other teammate. I'll share the writeup soon

## Broken Code

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FDR9RLXRIQJ4QMZrT6PJL%2Fimage.png?alt=media&#x26;token=546044cf-62bf-401e-ac0f-b790e29adfd4" alt=""><figcaption></figcaption></figure>

## Quantum Paradox

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2F2YmwjRSvaJiEDNaYJda9%2Fimage.png?alt=media&#x26;token=9b0b79fd-8d5d-43c5-8dac-9b82a0ec28f4" alt=""><figcaption></figcaption></figure>

YEAH , 0 Solves, there was only this one small file `processor.wasm` and not sure how is this supposed to help? I'll add the writeup when we receive the official writeup for this

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FxLlwucF39WE5u3RcH4pj%2Fimage.png?alt=media&#x26;token=592aa466-84a1-4ac2-88d0-23d3680efcb7" alt=""><figcaption></figcaption></figure>
