#### Requirements
+ Programming Language: JS
+ RCE: Finding and Exploitation

#### Objective
This is a difficult challenge with no hints provided. Use external resources and research techniques to brainstorm potential exploitation methods. Your goal is to achieve remote code execution and read the `/flag` file to complete the challenge.

Gladius

Examine the login process closely to discover and exploit a logical vulnerability.

#### Requirements
+ Category: Broken Authentication
+ Skill: Logical Analysis of Authentication Flows
+ Objective: Unauthorized Account Access

#### Objective
Log in to the web application and carefully observe the authentication flow. Pay close attention to any extra steps or unusual behavior. Understand the underlying logic, identify a flaw, and exploit it to log in as the user `mamad` to complete the challenge.


Easy Auth

Analyze the application's authentication flow and investigate potential flaws in cookie handling.

#### Requirements
+ Category: Broken Authentication
+ Skill: Cookie Analysis and Manipulation

#### Objective
Carefully review the authentication flow and monitor the cookies for any unusual behavior. Identify a vulnerability that allows you to manipulate cookies and escalate privileges to become an administrator. Successfully achieve administrative access to obtain the flag.


Broken Auth

Use the path `/proxy/internal_website/mamad.txt` to investigate its behavior and potential for exploitation.

#### Requirements
+ Topic: Attacking Secondary Contexts in Web Applications
+ Skill: Understanding Proxy Behavior
+ Vulnerability: Path Traversal, SSRF

#### Objective
Determine if the path sends an HTTP request to an internal server. If so, manipulate the path to access forbidden locations on the internal server and retrieve the private note.

Simple SSRF

This challenge replicates a real-world $3500 bug. Investigate the application to uncover misconfigurations.

#### Requirements
+ Vulnerability Type: Security Misconfiguration
+ Skill: Server-side investigation and Misconfiguration Exploitation

#### Objective
The challenge will load as a blank page, this is the intended behavior. Your task is to identify a vulnerability caused by misconfiguration and exploit it to read the `/flag` file on the server.


Real Mis

A real world IDOR which is harder to find:
- Login into the web application
- Watch the corresponding users’ ID
- Find a way to disclose other users ID
- You may need to play with the API a little bit
- Objective: find the admin’s user information

Safe UUID

Analyze the application's password recovery process to uncover and exploit vulnerabilities in authentication.

#### Requirements
+ Category: Broken Authentication
+ Skill: Reconnaissance and Exploiting Weak Token Generation

#### Objective
Carefully examine the "Forgot Password" functionality. Look for patterns in the password reset links, Can you guess another user's reset link? Use the endpoint `/api/v1/:email` to gather information (this step is outside the challenge scope). Focus on narrowing your recon to identify the administrator's account. Exploit the vulnerability to access the administrator's account and browse the `/admin` panel.


Thor

Investigate the application's confirmation functionality to identify logical vulnerabilities.

#### Requirements
+ Category: Broken Authentication
+ Skill: Analyzing Logic Flaws

#### Objective
Carefully examine the confirmation functionality for logical flaws. While not part of the challenge, you can gather information using `/api/v1/:email`. Use this information to uncover and exploit a logical vulnerability. Successfully exploit the vulnerability to access the `/admin` panel.


#### Requirements
+ Programming Language: JavaScript
+ Cross-Origin Resource Sharing (CORS): Filters Bypass

#### Objective
Your goal is to exploit a CORS misconfiguration to steal the admin's `API_KEY`. Begin by logging into the provided credentials and monitoring all HTTP requests. Carefully analyze these requests for potential CORS issues. Conduct tests to identify and exploit the misconfiguration, then craft a malicious link to trick the admin and exfiltrate their `API_KEY`.

#### Credentials:
Admin:
- Username: `voorivex_lab`
- Password: `supersecretpassword`

User:
- Username: `user`
- Password: `user`


GoodCMS

Use the application's functionality to explore and bypass the applied filter.

#### Requirements
+ Server-Side Request Forgery (SSRF)
+ Skill: Filter Bypassing Techniques

#### Objective
This challenge includes a filter designed to restrict SSRF attempts. Your task is to bypass the filter and successfully access the internal endpoint at `localhost:3000/admin`.

Cobalt

Analyze the web application for a vulnerable endpoint and craft a payload to execute a DOM-based Cross-Site Scripting (XSS) attack.

#### Requirements
+ Cross-Site Scripting(XSS)
+ Skill: JavaScript Analysis and Payload Crafting


#### Objective
Identify a point in the application's DOM where user input is improperly sanitized, craft a malicious payload.

DOM XSS 1

Explore the application to identify an endpoint and leverage directory traversal to access sensitive files.

#### Requirements
+ Security Misconfiguration
+ Skill: Directory Traversal
+ Webserver: Nginx

#### Objective
Spot an endpoint within the application and attempt to navigate through directories to locate and retrieve the flag from the source code files.

Travel

Use the parameter `/?source=true` to view the source code.

#### Requirements
- Programming Language: PHP
- Skill: Source Code Auditing
- SQLi: Blind technique in boolean values

#### Objective
Your goal is to extract the flag from the database by exploiting a SQL injection vulnerability

SQLi Level 3 - Boolean Blind

Analyze the uploader functionality to identify weaknesses in its design and bypass file upload restrictions.

#### Requirements
+ Vulnerability Type: Insecure Design
+ Skill: Uploader Tricks

#### Objective
Try to read the `/flag`

Safe Uploader

Identify and exploit weaknesses in the application's checker function to bypass its restrictions.

#### Requirements
+ Server-Side Request Forgery (SSRF)
+ Skill: Understanding and Bypassing Input Validation

#### Objective
Your goal is to bypass the checker function and successfully access the `/admin` endpoint.


Server Side Request Forgery 4

Server Side Request Forgery 3

Investigate the application's authentication mechanism and analyze its cryptographic implementation.

#### Requirements
+ Cryptographic Failures
+ Skill: JWT Analysis and Token Tampering

#### Objective
Register a user and log in to observe the JWT. Analyze the token and identify potential vulnerabilities. Although the `id` claim appears to be a randomly generated value, tampering with the token could grant access to the administration panel. Use basic application reconnaissance techniques to uncover the administrator's `id`. Your goal is to successfully access the `/admin` route by exploiting weaknesses in the cryptographic design.

Odin

Use the parameter `/?source=true` to view the source code.

#### Requirements
- Programming Language: PHP
- Skill: Source Code Auditing
- SQLi: WAF Bypassing techniques

#### Objective
Your goal is to extract the flag from the database by exploiting a SQL injection vulnerability and bypassing the WAF

SQLi Level 5 - WAF Bypass 1

Use the parameter `/?source=true` to view the source code.

#### Requirements
- Programming Language: PHP
- Skill: Source Code Auditing
- SQLi: Time-based technique

#### Objective
Your goal is to extract the flag from the database by exploiting a SQL injection vulnerability

SQLi Level 4 - Time Blind

Investigate the web application for misconfigurations that reveal sensitive information.

#### Requirements
+ Vulnerability Type: Security Misconfiguration
+ Skill: Triggering and Analyzing Debug Information

#### Objective
Your task is to identify and exploit a misconfiguration in the application to generate a stack trace, exposing sensitive information.

PHP CMS

Server Side Request Forgery 2

#### Requirements
+ Programming Language: PHP
+ RCE: Filtering bypass

#### Objective
Your goal is to execute code on the server and read the `/flag` file by identifying a way to inject commands without breaking the context.

Remote Code Execution 3

#### Requirements
+ Programming Language: PHP
+ RCE: Context Breaking and Filename Validation Bypass

#### Objective
Your goal is to read the `/flag` file by breaking the context with specific characters, analyzing the filename validation logic, and adjusting the input to achieve code injection.

Remote Code Execution 2

This challenge simulates a **real-world IDOR** vulnerability that’s harder to spot. The goal is to exploit an issue with how user IDs are managed in the system.  

### Steps  
1. **Login** into the web application and observe the user’s unique ID.  
2. **Find a way** to disclose other users' IDs. You may need to inspect API calls or analyze the requests in the background.  
3. Use your findings to **access the admin’s attachment (ID: 23)**.  

### Requirements  
- **Knowledge of API Interactions**: You may need to interact with the API to discover hidden endpoints or data.  
- **Exploration of the Application**: Observe how the system handles user IDs and determine if they can be manipulated.  
- **Insecure Direct Object Reference (IDOR)

### Objective  
Your goal is to find a way to **access the admin's attachment** by exploiting an **IDOR vulnerability** in the web application.  


Hack the Object

Use the parameter `/?source=true` to view the source code.

#### Requirements
- Programming Language: PHP
- Skill: Source Code Auditing
- SQLi: UNION technique in integer values

#### Objective
Your goal is to extract the flag from the database by exploiting a SQL injection vulnerability

SQLi level 2 - Integer UNION

Use the parameter `/?source=true` to view the source code.

#### Requirements
- Programming Language: PHP
- Skill: Source Code Auditing
- SQLi: UNION technique in string values

#### Objective
Your goal is to extract the flag from the database by exploiting a SQL injection vulnerability

SQLi Level 1 - String UNION

#### Requirements
+ Programming Language: PHP
+ Command Injection: Command Separators, Out-of-Band Data Exfiltration

#### Objective
Your goal is to exploit the blind command injection vulnerability by using a command separator to execute commands on the server. Use an Out-of-Band (OOB) technique to retrieve command output and read the `/flag` file.


Command Injection 2 - Blind

Server Side Request Forgery 1

#### Requirements
+ Programming Language: PHP
+ Command Injection: Command Separators

#### Objective
Your goal is to exploit the command injection vulnerability by inserting a command separator to execute additional commands on the server and read the `/flag` file.

Command Injection 1

#### Requirements
+ Programming Language: PHP
+ RCE: Basic Remote Code Execution via Context Breaking

#### Objective
Your goal is to achieve PHP code execution via context breaking to read the `/flag` file.

Remote Code Execution 1

گواهینامه شرکت در کلاس هانت به مدت ۶ ماه، در این مدت مباحث و متدولوژی هانت به بچه‌ها آموزش داده شد، این گواهینامه فاقد امتحان است.

Narutow Hunters

گواهینامه شرکت در کلاس، نفراتی که در امتحان شرکت نکردند و یا قبول نشدند این گواهینامه را دریافت کرده‌اند

OWASP Participation

The challenge, named 'Escape the Blackhole' is designed for the Narutow Hunt class's talent program. Anyone can participate in this challenge, as it serves an educational purpose as well. Participants who successfully solve all the levels of the challenge will receive instructions on how to sign up for the talent list. There will be a lottery for participants on the list to class participation. The challenge requires a basic understanding of networks, web applications, HTTP, JavaScript, programming concepts, a basic understanding of security (not steganography or forensic), effective use of search engines such as Google, and critical thinking. It is crucial to approach each level with attention to detail. Remember to closely examine the provided puzzle pieces to successfully solve each level. The challenge levels do not require brute force or fuzzing over the HTTP protocol; however, there might be offline brute force involved in some levels. Please refrain from conducting fuzzing, as it may result in a permanent IP ban. During the challenge, feel free to use Google, ChatGPT, and other online resources for assistance. The challenge will be available for 10 days until March 7th, although the deadline for the Talent program is sooner, and the details will only be revealed to those who successfully complete the challenge! Please note that the levels are not sorted from easiest to most difficult.