CTF Cheatsheet

รวมโพย quick-reference สำหรับ Capture The Flag — sen7

webpwncryptoreversingforensics

Recon

nmap -sC -sV -p- TARGET
gobuster dir -u URL -w /usr/share/wordlists/dirb/common.txt
ffuf -u URL/FUZZ -w wordlist.txt

Web

SSTI: {{7*7}}, ${7*7}, <%= 7*7 %>
SQLi: ' OR 1=1 --
LFI: ../../etc/passwd
JWT: alg:none, brute secret

Pwn

checksec ./bin
gdb ./bin
ROPgadget --binary ./bin

Crypto

RSA: factor, Wiener, Hastad
XOR: cyberchef, crib drag

Forensics

file -, strings -, binwalk -, exiftool -
volatility -f mem.dump imageinfo