CSAW 2021 writeups

Last update: Oct 06, 2021

Related tags

Security related resources CSAW2021

Overview

CSAW 2021 Writeups

Challenge	Category	Solved by
The Magic Modbus	ics	root2thrill
Lazy Leaks	Forensics	root2thrill
Poem Collection	warm-up	root2thrill
Turing	warm-up	root2thrill
Password Checker	warm-up	dancing.pickle
checker	warm-up	root2thrill
Weak Password	misc	root2thrill
Sonicgraphy Fallout	Forensics	root2thrill
a pain in the BAC(net)	ics	root2thrill
Alien Math	pwn	dancing.pickle
mic	forensics	dancing.pickle
Contact Us	forensics	dancing.pickle
Crack Me	warm-up	root2thrill

Notes:

Overall we placed 211th of 1216 teams with 1+ points. We competed as a duo (myself and my friend M-Pepper) and we were strong on forensics and stego, but weak on web, reversing, and pwn. I felt like with more time we could have done better on a couple of the RSA problems. Infrastructure was a bit unstable at times, but we still learned a lot and are grateful to participate in CSAW 2021. Looking forward to next year!

Owner

GitHub Repository

🍯 16 honeypots in a single pypi package (DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, VNC, SMB, SOCKS5, Redis, TELNET, Postgres & MySQL)

Easy to setup customizable honeypots for monitoring network traffic, bots activities and username\password credentials. The current available honeypot

259 Dec 31, 2022

com_media allowed paths that are not intended for image uploads to RCE

CVE-2021-23132 com_media allowed paths that are not intended for image uploads to RCE. CVE-2020-24597 Directory traversal in com_media to RCE Two CVEs

67 Nov 09, 2022

Instagram brute force tool that uses tor as its proxy connections

Insta-crack This is a instagram brute force tool that uses tor as its proxy connections, keep in mind that you should not do anything illegal with thi

3 Jan 28, 2022

Find vulnerable Log4j2 versions on disk and also inside Java Archive Files (Log4Shell CVE-2021-44228)

log4j-finder A Python3 script to scan the filesystem to find Log4j2 that is vulnerable to Log4Shell (CVE-2021-44228) It scans recursively both on disk

431 Dec 22, 2022

Password-Manager GUI

PASSWORD-MANAGER This repo contains all the project files. Project Description A Tkinter GUI that allows you to store website info like website name,

1 Dec 08, 2021

Separate handling of protected media in Django, with X-Sendfile support

Django Protected Media Django Protected Media is a Django app that manages media that are considered sensitive in a protected fashion. Not only does t

46 Nov 12, 2022

The First Python Compatible Camera Hacking Tool

ZCam Hack webcam using python by sending malicious link. FEATURES : [+] Real-time Camera hacking [+] Python compatible [+] URL Shortener using bitly [

109 Dec 28, 2022

To explore creating an application that detects available connections at once from wifi and bluetooth

Signalum A Linux Package to detect and analyze existing connections from wifi and bluetooth. Also checkout the Desktop Application. Signalum Installat

56 Mar 03, 2021

Dome - Subdomain Enumeration Tool. Fast and reliable python script that makes active and/or passive scan to obtain subdomains and search for open ports.

DOME - A subdomain enumeration tool Check the Spanish Version Dome is a fast and reliable python script that makes active and/or passive scan to obtai

329 Jan 01, 2023

MongoDB-Injection - This challenge-script is custom-made for web-server running MongoDB which is vulnerable to No-SQL injection

MongoDB-Injection Cheesy Multi-threaded script for NoSQL Injection This challeng

2 Jun 06, 2022

A python base script from which you can hack or clone any person's facebook friendlist or followers accounts which have simple password

Hcoder This is a python base script from which you can hack or clone any person's facebook friendlist or followers accounts which have simple password

3 Dec 06, 2021

This is a simple tool to create ZIP payloads using a provided wordlist for the symlink attack (present in some file upload vulnerabilities)

zip-symlink-payload-creator This is a simple tool to create ZIP payloads using a provided wordlist for the symlink attack (present in some file upload

6 Aug 18, 2022

CSAW 2021 writeups

Related tags

Overview

CSAW 2021 Writeups

Owner

🍯 16 honeypots in a single pypi package (DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, VNC, SMB, SOCKS5, Redis, TELNET, Postgres & MySQL)

com_media allowed paths that are not intended for image uploads to RCE

Instagram brute force tool that uses tor as its proxy connections

Find vulnerable Log4j2 versions on disk and also inside Java Archive Files (Log4Shell CVE-2021-44228)

Password-Manager GUI

Separate handling of protected media in Django, with X-Sendfile support

The First Python Compatible Camera Hacking Tool

To explore creating an application that detects available connections at once from wifi and bluetooth

Dome - Subdomain Enumeration Tool. Fast and reliable python script that makes active and/or passive scan to obtain subdomains and search for open ports.

MongoDB-Injection - This challenge-script is custom-made for web-server running MongoDB which is vulnerable to No-SQL injection

A python base script from which you can hack or clone any person's facebook friendlist or followers accounts which have simple password

This is a simple tool to create ZIP payloads using a provided wordlist for the symlink attack (present in some file upload vulnerabilities)

Fetch Chrome, Firefox, WiFi password and system info

Scan your logs for CVE-2021-44228 related activity and report the attackers

Blinder is a tool that will help you simplify the exploitation of blind SQL injection

Extendable payload obfuscation and delivery framework

RedTeam-Security - In this repo you will get the information of Red Team Security related links

Exploit for GitLab CVE-2021-22205 Unauthenticated Remote Code Execution

Python library to remotely extract credentials on a set of hosts.

python script for hack gmail account using brute force attack