Head-dump (Easy)

  • Challenge Link: https://play.picoctf.org/practice/challenge/476?category=1&difficulty=1&page=1
  • Challenge Description: Welcome to the challenge! In this challenge, you will explore a web application and find an endpoint that exposes a file containing a hidden flag. The application is a simple blog website where you can read articles about various topics, including an article about API Documentation. Your goal is to explore the application and find the endpoint that generates files holding the server’s memory, where a secret flag is hidden.
  • Hints:
    1. Explore backend development with us
    2. The head was dumped.

Solution

The site is a simple blog website and clicking the links will take you to various parts of the website.

front

The important link is the #API Documentation link, clicking it will lead you to a site mentioning how API works. Scroll down until you see /heapdump, heapdump contain a snapshot of all the live objects that are being used by a running Java application on the Java heap. You can obtain detailed information for each object instance, such as the address, type, class name, or size, and whether the instance has references to other objects.

api 
sitename.com/heapdump

Now, using Linux, trying to cat the file out output almost 60000+ lines of text, which is a lot. So we must use a command that can help us narrow that number down.

grep -o "picoCTF{[^}]*}" heapdump-1768932700736.heapsnapshot
Our flag: picoCTF{Pat!3nt_15_Th3_K3y_3c285d2f}
Decode

Let me explain how this works:

grep = Global Regular Expression Print

  • scans a file line by line
  • looks for text that matches a pattern (a regex)
  • prints matching results

Only print the part of the line that matches the pattern

-o

Matches the literal text picoCTF{ so we can anchor the start of the flag

picoCTF{

The special part:

[  ] means character class
^ (inside brackets) means NOT
} is the closing brace (for picoCTF{})
* means zero or more times

In plain english, it means to match any character (letters, numbers, underscores, symbols until we hit }) EXCEPT '}', any number of times

Sources