Mermaid

alfactf

Task: JavaScript web game with server-side API for tracking flag letter collection. Solution: Bypassed game logic by directly calling API endpoints (next-letter → collect-letter) without actually playing, exploiting missing server-side validation.

api_abuse game_hacking javascript client_side_validation session_manipulation

API endpoint enumeration from client JSGame logic bypass via direct API callsServer-side validation absence exploitation

$ ls tags/ techniques/

api_abuse game_hacking javascript client_side_validation session_manipulation

API endpoint enumeration from client JSGame logic bypass via direct API callsServer-side validation absence exploitation

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ grep --similar

Similar writeups

[web][Pro]Блекджек на раздевание (Stripping Blackjack)— bug-makers
[web][Pro]Кошачья CVEтыня— bug-makers
[web][Pro]Сила воли (Willpower)— duckerz
[web][Pro]Маскарад (Masquerade)— bug-makers
[web][Pro]Booty— alfactf