This page looks best with JavaScript enabled

Vulncon CTF

 ·  ☕ 2 min read


PHP Master

Reading the challenge description the first thing I thought of was to look for hidden files so ran dirsearch:

Found a /projects folder so when we visit it we get this banner:

However if we take a look at the source code there is an interesting comment:

<img src="justsomerandomfoldername/image-0.png">

Checked the image and turns out is a QR, which no apparent hidden data:
QR 0

At this point checked in case there are more images following the same naming convention image-X.png so went for the 27 as the banner on /projects pointed out:

QR 27

Additionally did an intruder scan with BurpSuite to check what images are available:


Both intruder and the image are indicating that the qr 13 is hidden data, so ran an exiftool to it:

[jusepe@nix:~/Documents/CTFs/vulncon]$ exiftool image-13.png 
ExifTool Version Number         : 12.12
File Name                       : image-13.png
Directory                       : .
File Size                       : 946 bytes
File Modification Date/Time     : 2020:12:19 14:56:29+01:00
File Access Date/Time           : 2020:12:19 14:56:38+01:00
File Inode Change Date/Time     : 2020:12:19 14:56:30+01:00
File Permissions                : rw-r--r--
File Type                       : PNG
File Type Extension             : png
MIME Type                       : image/png
Image Width                     : 290
Image Height                    : 290
Bit Depth                       : 1
Color Type                      : Grayscale
Compression                     : Deflate/Inflate
Filter                          : Adaptive
Interlace                       : Noninterlaced
XMP Toolkit                     : Image::ExifTool 12.04
Creator                         : aWh5YXBiYXtqQCRfN3UxJF8zaTNhX0BfajNvX3B1QHl5M2F0Mz99
Image Size                      : 290x290
Megapixels                      : 0.084

There is an interesting Creator header so with help of CyberChef got the flag:


r4t3 L1m1t

PHP Master

When we browse the web the only thing we see is an OTP:


It makes a get request with a parameter for each digit:

[jusepe@nix:~/Documents/CTFs/vulncon]$ curl "" && echo ""
{"msg":"Your Flag Is  L0L"}

After 10 tries you get banned for 1 minute:

[jusepe@nix:~/Documents/CTFs/vulncon]$ curl "" && echo ""
Our Developers Are Smart Enough To Implement Rate Limit !

Searching for ways of bypassing the ratelimit found this hacktricks post, the article suggest to change the letter casing so tried bruteforcing to /Enterotp.

This endpoint has a 100 request limit which wasn’t enough so kept trying stuff so tried the following headers:

X-Forwarded-For: Dashboard

Adding the headers by it’s own didn’t change anything. After some time of struggle switched the request method, hoping that the endpoint processes it too and voilà:

POST bypass

At this point we are able to bruteforce the endpoint, I used BurpSuite Intruder with Cluster Bomb for it. After the bruteforce ends there is a response with different content length:


Paying attention to the response, removed the X- headers and got the flag:


Share on

InTernet lover