neale/moth
neale
/
moth
mirror of https://github.com/dirtbags/moth.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

70pt webapp puzzle

This commit is contained in:
Curt Hash 2009-10-13 15:50:08 -06:00
parent 5ba0e55a18
commit 5a8004468e
5 changed files with 91 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
puzzles/webapp/70/,binary.png Symbolic link
View File

@ -0,0 +1 @@
../10/,binary.png

1
puzzles/webapp/70/,ctf.css Symbolic link
View File

@ -0,0 +1 @@
../10/,ctf.css

86
puzzles/webapp/70/7.cgi Executable file
View File

@ -0,0 +1,86 @@
#!/usr/bin/python
import os
import cgi
import cgitb
cgitb.enable(context=10)
#if os.environ.has_key('QUERY_STRING'):
# os.environ['QUERY_STRING'] = ''
fields = cgi.FieldStorage()
import Cookie
c = Cookie.SimpleCookie(os.environ.get('HTTP_COOKIE', ''))
content = {
'joke1' : '<p>An infinite number of mathematicians walk into a bar. The first one orders a beer. The second orders half a beer. The third, a quarter of a beer. The bartender says <em>You are all idiots!</em> and pours two beers.<p>',
'joke2' : '<p>Two atoms are talking. One of them says <em>I think I lost an electron!</em> and the other says <em>Are you sure?</em> The first replies <em>Yeah, I am positive!</em></p>',
}
if c.has_key('content_name') and c.has_key('content'):
k = c['content_name'].value
try:
c['content'] = content[k]
except KeyError:
c['content'] = '<p><em>key = s4nNlaMScV</em></p>'
else:
c['content_name'] = 'joke1';
c['content'] = content['joke1']
print 'Content-Type: text/html\n%s\n\n\n' % c
print ''
print '''
<html>
<head>
<title>7</title>
<link rel="stylesheet" type="text/css" href=",ctf.css" media="all" />
<script type="text/javascript">
function readCookie(key) {
var s = key + '=';
var toks = document.cookie.split(';');
for (var i = 0; i < toks.length; i++) {
var tok = toks[i];
while (tok.charAt(0) == ' ') {
tok = tok.substring(1, tok.length);
}
if (tok.indexOf(s) == 0) {
return tok.substring(s.length, tok.length);
}
}
return null;
}
function getContent() {
content = readCookie("content");
document.getElementById("stuff").innerHTML = content.substring(1, content.length-1);
}
window.onload = getContent;
</script>
</head>
<body>
<div id="wrapper">
<div id="content">
<h1>Web Application Challenge 7</h1>
<p>Through some manipulation or interpretation of this CGI script
and the HTML page(s) that it generates, a 10 character key can be
found.</p>
<p><strong>Find the key!</strong></p>
<div class="vertsep"></div>
<div id="stuff"></div>
'''
print '''
</div>
<div id="footer">
<p>Copyright &copy; 2009 LANS, LLC.</p>
</div>
</div>
</body>
</html>
'''

1
puzzles/webapp/70/key Normal file
View File

@ -0,0 +1 @@
s4nNlaMScV

2
puzzles/webapp/summary.txt
View File

@ -10,3 +10,5 @@
integers is caught and handled, so that no longer works.
60: the key is in the cookie. note the javascript that reads a value from the
cookie, hopefully causing the player to take a look at the cookie.
70: modify the cookie's content_name field to something invalid, reload the page
and the key will be printed on the page.