# CyVIT CTF 2021
## CyVIT CTF 2021
This CTF was part of a 2-day conference which included many talks given by various industry experts. It was a great opportunity for me to experience and learn new things! We managed to secure 5th place.
## CTF Name - AlgoBreaker
* **Category:** Easy
* **Points:** 100
### Challenge
> AlgoBreaker is just a simple code where you need to understand the algorithm and find the flag.
```php
6){
if ($dev < 99999 && $dev > 90000)
echo 'Flag: '.$flag;
else
print 'Oh Oh Think again
';
} else
print 'Wrong Move Champ
';
} else
print 'Not That hard . keep trying
';
} else
print 'Just read the source code once again';
}
?>
```
### Solution
I am not familiar with PHP, so I googled how functions like`isset()`, `strlen()`, `strpos()` work. \
Even if you don't know the language, knowing the fundamental programming concepts are key!
It seems the program is checking that:
1. Atleast something is passed in the "number" parameter.
2. The arguement passed is a number.
3. The number is an integer and/or doesn't have a decimal in it.
4. Length of the arguement passed exceeds 6 characters.
5. Number is between 90000-99999.
Now to get our flag, we have to meet all the above conditions.
Thus, we put the number 0096969 (for eg.) in the `?number=` parameter. \
Final URL: " and flag is obtained!
## CTF Name - Investigate
* **Category:** Easy
* **Points:** 100
### Challenge
> We have informed by our secret agents that few terrorists are trying to escape from our country. That's why we implemented strict checking on every borders. Although they successfully escaped but we captured their car's image. If somehow we can know their car's registration date, then we'll be able to catch them. Please help us.
>
> NOTE: Flag format is cyvit{dd-mmm-yyyy}
### Solution
It is clear we need to find a service that gives car details by it's license plate number.\
What better than a government site? I went [here](https://vahan.nic.in/nrservices/faces/user/citizen/searchstatus.xhtml) and put in `KA 03 MG 2784` after signing up.
\*At the time of solving challenge, the registration date shown here was 26th Nov 2006*.*
## CTF Name - Message UoU
* **Category:** Easy
* **Points:** 100
### **Challenge**
> Is this Really a code?
`-.-. -.-- ...- .. - -.-. --- -. --. .-. .- - ..- .-.. .- - .. --- -. ... --..-- --.- ..- . ... - .. --- -. -.-. .-.. . .- .-. . -..`
### Solution
At first glance, this seems like morse code. I typed "Morse Code to Text" into google and clicked on the first result that came back. Put the code into it and sure enough, we were given the flag (partially).
\*Had to sanitize and edit the flag obtained to fit into the given format
## CTF Name - Origin Checker
* **Category:** Easy
* **Points:** 100
### Challenge
> Origin checker is just written in easy Hyper Text markup Language
### Solution
It is clear that we need to find the password. The first place to look is the page source. Upon opening Inspect Element (using the combination `Ctrl+Shift+I` ), we can see the password written there.
The "=" at the end of the password suggests it might be encoded into Base64. \
After [decrypting](https://cryptii.com/pipes/text-to-base64) it, we get "supersecret\_cyvit". Enter the password and Login.
## CTF Name - NOCAB can solve this
* **Category:** Easy
* **Points:** 100
### Challenge
> 00010 10110 10011 01000 10010 00010 01101 01100 00110 10000 00000 10010 10011 01010 00000 10010 01000 01101 01100 10001 01111 10011 00100 10001 10010 01000 01101 01100 00010 01010 00100 00000 10000 00100 00011
### **Solution**
At first glance, this looks like binary, when decrypted it returns `.¦. ¬4.)¨.CY.Ì...Á(...` \
Maybe it's a cypher. I put it in [CyberChef](https://gchq.github.io/CyberChef/) and it decodes it from BACON cypher!
## CTF Name - Let Inspect
* **Category:** Easy
* **Points:** 100
### Challenge
> Glad to see you here. I have left a welcome gift for you as a token of appreciation. Open it.
### Solution
Simply decode the QR Code ([here](https://zxing.org/w/decode.jspx)) and you get the flag, cyvit{y0u\_4r3\_sm4r7}
## CTF Name - VIT VIT VIT
* **Category:** Easy
* **Points:** 100
### Challenge
> xgodb{Vjvzmimpttoqhia, jpmloqhi kezikzl} xgodb{Vjvzpttoqhia, jpmlmimoqhi kezikzl} xgodb{Vjvzezpttoqhia, jpmlmimoqhi kkzl}
### Solution
There are three identical ciphers here. My approach was to first find what kind of encryption is used here. Having very little knowledge of Cryptography, I used [this](https://www.boxentriq.com/code-breaking/cipher-identifier) cipher identifier tool to get a clue of what kind of cipher these might be. The tool indicated it might be Vignere Cipher.
Putting the key as `VIT VIT VIT` in a Vignere Cipher decoder, we got the flag!
## CTF Name - PYVERS
* **Category:** Easy
* **Points:** 100
### Challenge
> Sometimes you need to reverse back to get the flags
A zip file containing two files - script.py and output.txt were provided.
```python
alphabet = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j','k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z']
def shift(offset):
message = input("Input Message You Would Like Encrypted:\n")
new_message = ''
for letter in message:
letter = letter.lower() #doesn't handle upper-case yet
if letter.isalpha():
shift_pos = alphabet.index(letter) + offset
new_pos = alphabet[shift_pos]
new_message += new_pos
#these will not be shifted
elif ' ' or '/t' or '/n' in letter:
new_message += letter
elif letter.isnumeric():
new_message += letter
else:
print("An error took place in recording the message. Check input.\n")
print(new_message)
shift(-1)
```
The output.txt file contained, `Output - bxuhs{bzm_xnt_fds_qur}` .
### Solution
For this challenge, we had to understand the algorithm and reverse engineer our output.
The program acts as a rotation cipher. In this case, with an offset of -1.\
Which means if we shift each letter in our output by +1, we'll get our flag.
Therefore, Flag: cyvit{can\_you\_get\_rvs}
> Unfortunately, they took down the website whilst I was in the middle of writing these write-ups. :")
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://siphyshu.gitbook.io/siphyshu/ctfs/cyvit-ctf-2021.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.