oposec - null

ØxOPOSɆC - HTTP2

URL: https://20.56.49.147/ | Keep calm and get the flag :)When you enter the IP directly on the browser you see only an image sourced from Github and a hidden clue: "Lost? It's evolution, baby...": The image shows the evolution of the HTTP protocol, so it makes sense

crypto

ØxOPOSɆC - Don Joe [Crypto]

Don Joe insists his site is as secure as can be! Can you prove that the best web dev of all time is wrong?" URL: https://don-joes-blog.herokuapp.com/ There are two flagsDon Joe's Blog has a very simple interface and lists only 4 blog posts: Clicking on the articles

cryptography

ØxOPOSɆC - Secrets [Crypto]

We all have secrets! And sometimes we need to share them with our online friends, safely... That's easy! - Just implement a very secure, hackerproof™ secret sharing web application!" URL: https://secret.mbie.meWhen you access the website you see the following page: Entering random data on the input field

ctf

ØxOPOSɆC | Neuromancer

This month, I was responsible for putting together the ØxOPOSɆC monthly challenge. Even though the competition is done, if you want to try it out yourself the application is still available here. So, if you don't want spoilers, stop reading! Onto the solutions!The challenge consisted of a Heroku app

crypto

ØxOPOSɆC | Underground Leaks (Crypto) - Part II

Write-up for the second part of the Underground Leaks saga, that includes DTMF and Multi-tap Cipher.

crypto

ØxOPOSɆC | Underground Leaks (Crypto)

Write-up for retired Oposec's October challenge

sstv

ØxOPOSɆC Summer Challenge 2020 | Misc Challenges Write-up

1 . My Paste | 100Oh no! I forgot where I left my paste. 🗑 Perhaps you can help me find it?The source code has a little hidden clue: <span class="challenge-desc"><br> Oh no! I forgot where I left my paste. 🗑 <p>Perhaps you can

tap code

ØxOPOSɆC Summer Challenge 2020 | Crypto Challenges Write-up

Knock Knock (100)21 31 11 22 { 32 11 44 15 45 43 42 34 43 15 }If I had known about Tap Code (aka Knock Code) this would have been straightforward. I ended up getting the flag with some "leaps of logic". Basically, by knowing that the first 4

web

ØxOPOSɆC Summer Challenge 2020 | Web Challenges Write-up

Passive-Aggressive Flask (100)I can give you a flag, but you'll have to be nice. Remember to say it LOUD, so I can hear you. https://passiveaggressive.apl3b.com~ curl https://passiveaggressive.apl3b.com <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"

android

ØxOPOSɆC Baby Xmas Challenge 2019 | Android Rev

The APK for the original challenge can be downloaded here. The author's write-up can be downloaded here. We're given an Android Package (xmas_ctfzadas.apk) along with the following instructions: Baby pwn tu-tu-tu-tu! - Get the first two flags ({oposec}XPTO) locally; - For the brave ones, find a way

steg

ØxOPOSɆC Steg Challenge 2019 | Volatility

Write-up for ØxOPOSɆC steganography challenge that involves the analysis of a volatile memory dump.