NahamCon CTF 2023: Web Challenge Walkthroughs

Video walkthrough for some Web challenges from the NahamCon Capture the Flag (CTF) competition 2023 (organised by @NahamSec ); Star Wars, Stickers, Hidden Figures and Obligatory. Topics covered include XSS, domPDF RCE, hidden data (misc/stego) and SSTI with WAF filter bypass. Write-ups/tutorials aimed at beginners - Hope you enjoy 🙂 #NahamCon #NahamCon2023 #NahamConCTF #CTF #Pentesting #OffSec #WebSec

↢NahamConCTF↣

👷‍♂️Resources🛠

↢Chapters↣
0:00 Start
0:18 Star Wars (XSS)
4:07 Stickers (domPDF RCE via ttf/php polyglot)
11:45 Hidden Figures (Hidden data/embedded files)
17:55 Obligatory (SSTI + WAF)
25:26 End

[rilsan]

idk why ur explanation is easy to understand to me

[damnqais]

great writeups, for Obligatory i did |{{config}}| and got the flask session secret and changed the id from 2 to 1 (admin) and got the flag in the to do list :)

[LargeToboggan]

Great videos as always. One of the top content creators in this domain. I hope this is sustainable for you because I know how much work goes into all this while still having a job + keeping up to date with new techniques + personal. Take care of yourself! Best wishes

[frtyeven]

thanks for these videos. really helpful and well explained. keep doing what u're doing! much love <3

[kartibok]

Great work - and thanks for the ngrok - never seen that one before!!

[LearnTermux]

Damn I was looking for it. Thanks sir.

[BabeRyHellCat]

Could you please provide walkthroughs for the Video Intigriti CTF 2023? I'm really stuck with those challenges.

[astralwanderer]

Hey Jonah, great vid!
Will there be another one for the forensic/reverse challs as well:) ...?

[c-tch]

Great video :) I like the Color-Settings of your terminal. Is this a plugin for terminator or how did you costumize it?

[tangiispotted]

Great Video! Just wondering, what VM are you using?

[tazaccking]

can you explain how to solve blobber and tiny-little-fibers [nahamcon CTF], as i spent so much time on them but unsuccessful in solving them

[Daniel-puxh]

Great video! I think the intended way of obligatory was to leak the secret key from the flask app and forge a new cookie passing the id to 1. Once you became the admin the flag was there :-). But your way was faster 😅