Write-up Easyctf {Infinity Star Bank : WEB 375 points}

First, we have the website http://web.easyctf.com:10206/ , let go and do register and log in. But when login, It always go back to register. Let note: “Infinity Star”, because the website is on testing, I try to do register with in a “Infinity name account” -_- !! ( hex(100) = dec(256)  I think it is “Infinity”  :v ).

Screenshot from 2015-11-13 14:10:09

look like it has been infinity (the name and money is nothing)

but when I send money for anyone it’s doesn’t work because it’s block me 😥

Let see the code

Screenshot from 2015-11-13 14:22:36

yes, we can submit by the link http://web.easyctf.com:10206/api/bank/transfer?amount=100&recipient=%100joker

Of course it’s no simple like that :p

Screenshot from 2015-11-13 14:23:59

Let see hint “If the transfer money feature is still under testing, who do you think can use it?”

admin will check for me, please report it 😀

 

At this state, I use Tamper Data

Screenshot from 2015-11-13 14:45:36

wait a minute and buy flag 😀

This post is very sparing, if you have another way to do it, please comment below, Thanks 😀

GGWP by l4cl0i – TKOX

 

 

Advertisements

Trả lời

Mời bạn điền thông tin vào ô dưới đây hoặc kích vào một biểu tượng để đăng nhập:

WordPress.com Logo

Bạn đang bình luận bằng tài khoản WordPress.com Đăng xuất / Thay đổi )

Twitter picture

Bạn đang bình luận bằng tài khoản Twitter Đăng xuất / Thay đổi )

Facebook photo

Bạn đang bình luận bằng tài khoản Facebook Đăng xuất / Thay đổi )

Google+ photo

Bạn đang bình luận bằng tài khoản Google+ Đăng xuất / Thay đổi )

Connecting to %s