I started out 2020 pretty starry-eyed and excited I popped a babySQLi in PicoCTF. I figured DEFCON was a reasonable 7 year goal.
Never expected to be here, after 3 years. Not to be sappy, but I might just cry.
This weekend I played in DUCTF! I solved the hardest web challenge with a teammate. The writeup is here.
TL;DR - tsconfig.json isn’t actually json
Thank you to the organizers, especially for kicking me out of hibernation of my blog!
I have recently been getting a lot of requests to talk about how I started my CTF journey, how to get better, etc etc
I really appreciate that people respect me enough to value my insight, but I actually wanted to address a really saddening comment I sometimes see:
My friends say I have nice handwriting + they love looking at my notes. I’m NOT an expert in the topics I write about, these are less “how-tos” and more “fun stuff I learned” so I decided to host a few since I figure they may be helpful to someone:
Here is my author writeup for my challenge in MapleCTF, JUJUTSU KAISEN. The solve is: ServiceWorker-intercepted POST-based img-tag CSRF -> ESI injection into IDAT chunks of png -> image oracle XS-leak
Year recap!
Places visited: 🇮🇹🇸🇬🇯🇵🇨🇭🇵🇭
Highlights:
- made a bunch of new CTF friends
- DEFCON31
- Organizer of art design in hackceler8
- Authored a challenge for GoogleCTF
- Found BUGS
New Years Resolutions:
- more bugs!
- more friends!
- more places to visit!
GoogleCTF is over, thank you to all who played! I authored the web challenge “Grand Prix Heaven” and the own challenge “HEAT” with
@_tsuro
. Thank you to everyone who looked at those challenges!
A 2022 recap
—- graduated from UBC
—- Infosec engineer job
—- said goodbye to Vancouver
—- DEFCON First Place with team MMM!
—- Led MB into one of their best years so far
—- closed 2-3 years of team captaining for MB
—- MapleCTF 🍁
—- Travelled to Athens, Greece & Vegas, USA
A (late) life update:
I stepped down as
@maplebaconctf
team captain since I graduated from UBC this year - it feels right to pass the mantle from me to my fantastic successors. You’ll still see me playing with mb, I’m far from done with CTFs :> (I’ll miss you YVR)
Better late than never :P
FWIW I get kinda soap-opera-y here, but I've been reminiscing alot about my start in CTFs so that coalesced into a blog post pretty easily
Thank you thank you for participating in
@pb_ctf
⭐️ I authored the web challenge Makima, and my art of her is here. :> I hope you had fun, it was a bit sad cause my original idea of the challenge was too complicated to implement. Regardless. - I hope you had fun with it!
It's finally happening! pbctf 2023 is here
🗓️ Feb 18th, 14:00 UTC to Feb 20th 02:00 UTC (36 hours)
🎁 A $10,000 prize pool
Proudly sponsored by
@Zellic_io
@ZetaTwo
@LiveOverflow
My first month learning CTFs weren’t productive cause I learned the vuln in a vacuum so didn’t know of legit, real-world applications that I could use said vuln. When I reformatted my learning style to get the context first before the vuln, I started actually developing my skills
JUJUTSU KAISEN was my MapleCTF challenge, which was using an image primitive with an ESI:includes to include a graphql response and make an XS-Leak oracle out of invalid/valid image loads when you make a POST req (serviceworker intercepted). I made a few other small ones too.
MapleCTF has concluded 🍁🥓 Massive thank you to everyone who played. We Maple Bacon hope you had a fun time with our challenges! And special congrats to
@redrocket_ctf
,
@dicegangctf
and
@SHC_Challenge
for achieving top 3!!
I flew in to Vancouver to surprise visit my team for quals and I’m waiting in the airport for the red eye flight back operating on half a burger and a leftover can of monster energy drink
Seeing someone memorize all regex conventions and writing out complex regular expressions with no failures deeply terrifies me like wdym you don’t know what regex101 . com is
This happened a while ago, but I and some friends in Google did a little guest lecture at UBC over topics in computer security, and security engineering careers in general. It was fun. Thank you to
@nneonneo
for allowing me + my friends to share our thoughts :)
Come join us in the Google red team! We have a position open in NYC: The team is fantastic and the work is really cool. Message me if you have questions about the role but if you are interested please don't wait to get your application in.
Ask questions, and make sure that you take the opportunity every CTF challenge you try to learn every facet of it as possible within your means. Example: dont just learn XSS, learn how the browser DOM works. You will find yourself enjoying your learning journey,
In addition to the honor, CTFTime points and Binary Ninja licenses (courtesy of our sponsor,
@vector35
), the teams are also fighting over these gorgeous custom-made trophies which will be awarded to the top three.
Don't miss the chance to win one of these delicious masterpieces!
I just got mad cause I pulled on a chair and left a mark on the floor from the chair leg scraping across it and got upset at myself for not attaching those fuzzy chair leg stickers preventing this very scenario. Now the voice in my head that sounds like my mom is laughing at me