Hacker101 Micro-CMS v1 CTF Walkthrough

My first CTF will involve a hacker101 set of provided CTFs, Micro-CMS v1. The CTF is located here: https://ctf.hacker101.com/ctf. It is an easy CTF to solve hence would be a good starting point for a beginner.

Flag0: Stored XSS

Opening Micro-CMS v1, I get three:

I first visit the ‘create a new page’ link. When I create a new page, the details of the new page are reflected in the response. This is a good indication that the website might be vulnerable to XSS (Cross-site scripting). I test for XSS by editing the page title with this payload:

hello<script>alert(1);</script>

Going back home, the payload executes and I get the first flag. 😊

Flag1: Unauthorized Access

When I created my first page, I observed that it was assigned an id of 8

When I visit the two pages provided before, I observe that the pages have an id of 1 and 2. So I try to retrieve pages between 2 and 8. Page 5 responds with a 403 forbidden error while others respond with 404.

I poke around the system to look for other areas the page id is present and observe that the page id is also used when retrieving a page for editing.

I switch the page id to 5, refresh the page and get the third flag:

Flag2: SQLi

When editing a page, I notice that the page id is passed in the URL. I test this parameter for SQL injection by placing a ‘ (single quote) at the end of the id parameter and I get the second flag:

Flag3: Stored XSS

Since the input is reflected in the page, I have to find a way to bypass the markdown filter to execute XSS. After searching and trying different payloads, I come across this payload:

<button onclick=alert(‘xss’)>click</button>

The payload executes successfully but there is no flag displayed.

Viewing the source code, I find the flag:

Thank you for reading. If you enjoyed this article.

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store