WEB Challenges (I know Mag1k)

HTB Content Challenges
, ,
1

in here i got this
“Cookie: PHPSESSID=2q730tudrno1lkc534a5mj4033; iknowmag1k=76Q59%2FmPo9AllYbBtzkeF7H6mMTpCDkUBt18ec0MxJTUgPCIXjmhCw%3D%3D”

Even after doing research i didn’t get how to decrypt it , so i ended up seeing the walk-through in which told its a padding oracle .

Now my question is just by seeing the cookie how does one determine its padding oracle?

2

I suspected what it was for two reasons.

One, I built a similar challenge for another CTF around the time I went to see the challenge, which helped me to identify it quite fast.
Two, you can narrow down the set of available options and focus on certain tools because:

  1. It doesn’t look like a hash (hash-dentifier can help you there).
  2. It doesn’t decode to plaintext either.
  3. So, it’s some kind of crypto. From there, it can be maybe a textbook RSA, CBC byte flipping, hash length extension, you get the idea. Try, fail, remove it from the list and keep doing until something works.
3

some light google searching will reveal a tool that basically solves this challenge for you. oh well!

4

Is some still one this ? i am stuck on the last part of this challenge pm me

5

@uzmakin495 padBuster.pl can help you

6

Owned challenge ^^
“Easy” with the right tools and Syntax

Ask me (DM) if you need some help …

7

I am having trouble working with padBuster.pl in the newest version of kali. Noob here want some guidance

8

i don’t get why using automated tools tbh, ok, you got the flag but did you really learnt something?