Sdctf 2021

Git Good

Solved By : thewhiteh4t

  • Robots reveal an admin page and .git directory

  • I used a very useful tool which helps to dump file contents of websites which use GIT version control system
  • https://github.com/internetwache/GitTools

  • .git directory dumped :

  • now we can use extractor to get files from the dump

  • I found 2 users.db files, both are sqlite3 databases
  • one contains bcrypt hashes and other one contains md5 hashes
  • I cracked md5 hashes first because they take less time

  • one valid credential found :
aaron@cgau.sdc.tf : weakpassword
  • login on admin.html and we get the flag

Published on : 10 May 2021