Bengaluru's Most Wanted

solution.md|179 lines(5.0 KB)

🥊 Gundu Gopal CTF — Official Solution Writeup

#1.1 Reconnaissance

Navigate to https://ggr-fight-booking.vercel.app. You are greeted with GGR FIGHT BOOKING PORTAL — a login page asking for a "Fighter ID" and "Access Code".

#1.2 Source Code Inspection

Open DevTools with F12

You will notice:

HTML comments (red herrings):

<!-- GGR punches faces, not keyboards. I'm no nerd programmer.
     And my security? Unbreakable. You'd have to be cracking at pattangere station to get past it. -->
<!-- P.S. If you're bored: https://tinyurl.com/4kpk8auk -->

function validateLogin(user, pass) {
    const hash = CryptoJS.MD5(pass).toString();
    if (user === "challenger_01" && hash === "83a515cedeac731ed15f175c2145fca2") {
        sessionStorage.setItem("ggr_auth", "true");
        // redirect to portal
    }
}

# git index (partial recovery — corruption detected)
100644 blob 9f1a2c3  dontreadme.md
100644 blob 7d4e881  gundu_technique.rar
100644 blob b2c9e01  training_ground.jpg

# fetch via: /backup/<filename>

curl -O https://ggr-fight-booking.vercel.app/.git/dontreadme.md
curl -O https://ggr-fight-booking.vercel.app/.git/gundu_technique.rar
curl -O https://ggr-fight-booking.vercel.app/.git/training_ground.jpg

Bengaluru's Most Wanted

🥊 Gundu Gopal CTF — Official Solution Writeup

#1.1 Reconnaissance

#1.2 Source Code Inspection

#1.3 Analysing auth.js

#1.4 Cracking the Hash

#Stage 2: Git Information Disclosure — Finding the Leaked Files

#2.1 Identifying the Git Leak

#2.2 Accessing the Git Index

#2.3 Downloading the Leaked Files

#Stage 3: OSINT & Forensics — Unlocking the Archive

#3.1 Reading dontreadme.md

#3.2 Analysing the Photo (EXIF)

#3.3 Reverse Image Search

#3.4 Extracting the Archive

#Stage 4: Cryptography — Dancing Men Cipher & XOR Decryption

#4.1 Decoding the Dancing Men Cipher

#4.2 XOR Decryption

🥊 Gundu Gopal CTF — Official Solution Writeup

#Stage 1: Web Exploitation — Cracking the Login

#1.1 Reconnaissance

#1.2 Source Code Inspection

#1.3 Analysing auth.js

#1.4 Cracking the Hash

#1.5 Login

#Stage 2: Git Information Disclosure — Finding the Leaked Files

#2.1 Identifying the Git Leak

#2.2 Accessing the Git Index

#2.3 Downloading the Leaked Files

#Stage 3: OSINT & Forensics — Unlocking the Archive

#3.1 Reading dontreadme.md

#3.2 Analysing the Photo (EXIF)

#3.3 Reverse Image Search

#3.4 Extracting the Archive

#Stage 4: Cryptography — Dancing Men Cipher & XOR Decryption

#4.1 Decoding the Dancing Men Cipher

#4.2 XOR Decryption