The Dark Web
By Yashander Hooda · 2 min read
About the CTF: cyberheist
Team Name - Beyonder , Members- Yashander Hooda, Arnav Madan, Pulkit Pandey
Team name- Beyonders
Team members-
Yashander Hooda
Arnav Madan
Pulkit Pandey
The Dark Web
We needed four master key fragments which were hidden in the vercel website to make the flag.
When we spammed the site with script, the bot did Security CHeckpoint and every req generated useless html page. We ran out cmds from browser console instead. But curl was not passing the checkpoint so mostly it was just fetch() in devtools.
we were using claude model Opus 4.8 for probing with us, it has slightly lower safeguards. We gave it full context how this vercel website is just for the sake of this event. After that it followed with us
recon
checked robots.txt
It returned one same error which was he hint.
fragment 1- the cookie (ed94)
it gave many fake cookies but one was identical
_cfuid = 6332567a6331396c5a446b30
It was hex so we decoded it into base64 then again decoded the base64
so it gave ed94
fragment 2- debug (0971)
One node was marked as degraded and only cache ref was
"cacheref": "aW50ZXJuYWxfMDk3MQ==" ->(b64) internal0971
so 0971
fragment 3- the admin jwt (1a41)
the auth_token they give us is a JWT, decodes to role buyer level 0. /api/admin wants admin + level>=5. it's HS256 so if you know the secret you just make your own token.
secret was shadow2003 (whole site is themed around the year 2003, figured it'd be something like that). forged {role:admin, level:9} signed with it, hit /api/admin:
"system": { "masterkey": "31613431" ... }
31613431 is hex -> 1a41
(did the signing in the console with crypto.subtle, no library needed)
fragment 4- the backup (9ad1)
./backup/ just gave "Directory listing denied"
/backup/ (slash) -> "Directory listing denied"
/backup/xxxxx -> "Endpoint not found" as api json, not the normal html page
that difference means /backup/ is actually a function that'll hand you a real file if you name it right. so it's just a filename guessing game. ran a backup wordlist and the boring classic .sql.bak hit:
curl .../backup/db.sql.bak
it's a sql dump, mostly flavor (the md5s are just "password", theres a bitcoin address rabbit hole) but there's a comment in it:
NOTE: Full order history exported to /.old/export.csv
grab that:
.../.old/export.csv
every row's shipping_hash is 16 hex chars... except ORD-00007 which is only 8: 39616431. same odd-one-out trick as the degraded node. hex decode:
39616431 - 9ad1
we got all four fragments like this but we didn't knew the exact order or couldn't find anymore clue to it so we just used every combination and this one got accepted
CYBERHEIST{0971ed941a41_9ad1}
note: i worked through this with help from an AI assistant (claude opus4.8) - it drove a lot of the probing and the jwt forging, and helped spot the api-404 vs spa-fallback thing on the backup.