Main menu

User Rating: 0 / 5

Star InactiveStar InactiveStar InactiveStar InactiveStar Inactive
 

 

We'll start you out with Level 0, the Secret Safe. The Secret Safe is designed as a secure place to store all of your secrets. It turns out that the password to access Level 1 is stored within the Secret Safe. If only you knew how to crack safes...
You can access the Secret Safe at https://level00-1.stripe-ctf.com/user-XXXX. The Safe's code is included below, and can also be obtained via git clone https://level00-1.stripe-ctf.com/user-chkzwktfmr/level00-code.

This one was simple enough - the brunt of this one laid on line 34 of level00.js.

    var query = 'SELECT * FROM secrets WHERE key LIKE ? || ".%"';
Since there was no cleaning of variables, a simple query of % showed us everything in the "vault". 
 

 

Add comment


Security code
Refresh