My CTF Cheatsheet

Here's a cool image generated by a convolutional neural network from WPICTF 2019

---

Table of content

• general
• crypto
  • old ciphers
  • checklist
  • finite field stuff
  • rsa
• misc
  • checklist
• stegno
• pwn
  • Null Termination
  • bypass stack canary
  • heap
  • tip
• rev
• web
• bash
  • How to spawn a reverse shell
  • How to convert binary to hex
  • How to break bash commands apart
  • bypass filter
  • checklist

general

• CyberChef
• kt.gy
• OTA tips
• ctf-katana

crypto

• Integer factorization calculator

old ciphers

• bifid cipher
• pigpen cipher
• vigenere cipher
• rot13
• substitution cipher

checklist

• if get binary data, try xor
• LCG: try this from VolgaCtf2019
• LFSR: try this

finite field stuff

• if you know the roots for polynomial mod n, you can find the roots for the polynomial mod n+1 (check this)

rsa

• do you know how p and q are generated? try this
• use RSA’s malleability property to forge a signature (only works for unpadded message)
• recover private key from iPmQ and iQmP

misc

checklist

• is it an esolang
• corrupted header
• base encoding - base64, base62, base85, base91, etc
• zero-width char/zero font size
• if it is a zip, try john --wordlist=rockyou.txt --rules hash
• if have to fit regular expression, try rstr.xeger

stegno

• use montage -mode concatenate to concat images
• for lsb try zsteg -a

pwn

Null Termination

Do NOT read past first null byte

• strcpy()
• strncpy()

Do read past first null byte

• read()
• gets()
• fgets()
• memcpy()
• scanf()

Does copy the terminating nullbyte from src to dst

• strcpy()

from ota tips

bypass stack canary

provide the characters - or +, and the scanf will not change the value of the variable

from this

heap

• fastbin (size < 144 bytes or 0x90 bytes) - LIFO
• small bin (size < 1024 bytes or 0x400 bytes) - FIFO

tip

• You can't LD_PRELOAD a setuid binary but you CAN LD_PRELOAD an executable-only binary
• vsyscall have constant addr even when PIE is enabled
• constgrep to find syscall no.

rev

• use r2pipe to brute force key this
• is it 6502 assembly?
• angr with limitation. read this

web

• try to trigger error
• search existing bugs on github issues and CVEs
• phar files
• check http headers
• check sql (' or 1=1 --) and nosql ({"$ne": "null"}) injection
• try aws s3 ls s3://
• check robots.txt, .env, .git
• php hash tricks

bash

How to spawn a reverse shell

• Reverse Shell Cheat Sheet
• Reverse Shell as a Service

How to convert binary to hex

• od -vtx1
• xxd
• hexdump

How to break bash commands apart

• ;
• #
• ${IFS}

bypass filter

• /**/ matches all folders
• ? matches any character
• $0 refers to the parent program
• /usr/bin/x86_64 spawns a shell
• sh /FILE can read file

checklist

• try GTFOBins
• check out this

---