This post provides an overview of building a Firefox extension using React, TailwindCSS, and shadcn-ui components. Frontend development moves fast and this post covers a project which attempts to use the current latest technologies. Throughout this post, we will develop an extension called “eye-break” which allows users to configure a notification that appears on a regular interval. In order to keep the length of this post reasonable, we will skip the introductions of the technologies and assume the reader knows of them; this post will introduce how to use them.

First blog post in a while! I wanted to do a postmortem of DiceCTF which ran the past weekend (2/4/22-2/6/22) as we did a lot of things right but still had much we could improve on. I've also successfully poached ginkoid and asphyxia to add a lot of really insightful technical details around our infrastructure. We've wanted to do an infrastructure write-up for a long time and with all that went on with DiceCTF this felt like the perfect time to do it. In general, this blog post this will be from the perspective of someone handling the logistics and infrastructure side more so than the challenges side. Hopefully this offers an interesting read and some insight into what it takes to organize an event like DiceCTF.

Zer0pts challenges were well made and challenging. Shout out to all the web authors for coming up with these challenges, definitly learned more about client-side and server-side. Here are writeups for two of the challenges I worked on.

This will be a writeup for the challenge Ikea Name Generator from perfect blue ctf. The major components were prototype pollution, DOM clobbering, and angularjs sandbox escape.

HITCON CTF is no joke. The challenges were crazy hard and very interesting at the same time. This first writeup will be about oShell which was a sandbox escape. This will not cover the first section of the challenge but will focus more on the sandbox escape using tcpdump and ping.

We took part in TokyoWesterns CTF this past weekened and I focused on solving the web exploitation challenges. We were able to solve the first set of angular js challenges and I learned that recaptcha gadgets are very useful. Overall, the CTF definitely deserves its high point value and it was very fun and educational.

Cross-Site WebSocket Hijacking or (CSWSH), yes the acronym is absurdly long, is a technique where an attacker can hijack a WebSocket on a targetted site and essentially send and receive messages like the victim. In this blog post, I will specifically explore how this can be done with socketio when the requests are not upgraded to actual WebSockets. In addition to explaining how this attack type works, this post will include a specific writeup for Support Chat, a CTF problem from HacktivityconCTF.

Flaky was a web challenge with a pretty interesting attack that I didn't know about. It deals with how a HEAD request is handled internally and how that can lead to authentication problems.

Over the past week, RedpwnCTF 2020 took place and I was one of the organizers of the event. I would really like to give props to my team members and additional organizers of the contest for putting together such an event.

This ctf had so many misc and forensics problems that I wasn't really interested in solving however I did finish the web problems as well as some crypto problems. The web problems were pretty trivial inspect element challenges except for the JWT attack and the XML external entitiy inclusion attack which I have written up. On the other hand I started doing cryptography problems which I find pretty interesting and have also started to build my own repository with tools for cryptography.

I played tjctf with interlake high school cyber (ihscy) and it was tons of fun working with new people on interesting problems. I learned a lot of binary exploitation techniques this ctf as it was one of the first were I was both able to exploit them and focused on it instead of web. Working with Ian on some of the pwns was really fun and hopefully I'll be able to have a similar experience in the future.

I didn't have much time to look at this ctf but I was able to solve one web problem. This was interesting to me because I faced some difficulties in getting my payload to work and learned some concepts about the dom.

I did two web challenges for TAMU CTF and they were mostly applications of standard attacks. The sql inejection was interesting because it was not immediately obvious that it was injectable.

HackTM challeneges were pretty unique and challenging. I didn't spend much time on the ctf and only was able to solve the first web challenge which exploited unicode and objects in javascript to get the flag.

This was the second web challenge we solved in Whitehat I thought this problem was much more interesting than the first.

I did WhitehatCTF with DiceGang this weekend and focused on the webs. We did pretty well and placed second in the quals right after perfect blue. I thought a couple of them were pretty cool but would have been much better with source. In my opinion, sourceless web ctf challenges should rarely exist.

ChristmasCTF had some interesting problems. We started late but still did pretty well. I focused mainly on web and tried to do some of the easier pwn problems. The CTF wasn't on CTFTime but was located at https://x-mas.aleph.kr/.

The one binary exploitation problem I tackled this CTF was solo_test which was a 64 bit binary. The problem seemed to be a standard problem yet it has been one of my first successful exploitations in competition and was a good learning experience.

This is my first blog post and I'm writting it a while after the CTF has concluded however I need to start somewhere right? I wasn't able to contribute much to this CTF as I was preparing for finals. However, I did have a great time solving and attempting what I could and it was great to work with other members of redpwn.