TCS HACKQUEST PLAYGROUND WALKTHROUGH

Hello Hackers! I hope you're doing well. This blog is a part of KeyCybr Internship.

Recently I came across the TCS Hackquest Playground, and here I'll be giving an insight into the solution for the same.

The link to register for the same is https://play.tcshackquest.com/register 

This playground is like a warm-up before the actual TCS Hackquest, which is probably scheduled for January 2022.

Let's dive into the challenges.

Challenge 1: Time to play with J.S. 

As you click on "Link here" you'll be redirected to a page that looks like 

You'll have to enter the value here to get the flag. Now, since there's nothing visible on the page, the fundamental thing that should strike you must be viewing the page source!

As you visit the page source, you'll see

The variable contains a base 64 string. On decoding it with the base 64 decoder

You'll get submitthis: {text_to_be_submitted}

As you submit the text and click on Retrieve the Flag, you'll receive your first flag!

Challenge 2: The Flash

As you click on "Gone in a Flash," you'll see a page refresh 10 times in front of your eyes, and you may feel helpless as you won't be able to stop it :P

However, to overcome this, you just need to use burpsuite or zap proxy. 

Intercept request for each uuid and view the response for the same. 

In one of the responses, you'll find the flag!

 Challenge 3: The Elawn Musk

Download the Tweet collection CSV file.

As we analyze the file, you'll find 

and you'll also see 

Now you have the text and the key. All we need to find out is the method of encryption.

From this line, it seems as if we have ECB. On doing further research, you'll come to know that encryption is AES 128 bit ECB mode encryption.

All you have to do is remove the first 8 bits of plain text and use the key.

After doing the same, you'll get a base 64 string. You'll bring plain text on decoding it, which you'll need to enter on the page given in the challenge.

 

Thus you'll get the final flag for the challenge as well.

Overall, the last challenge was a bit tricky, whereas the initial two challenges were comparatively easy.

P.S. Apologies for the blurry images😔. However, I hope that the content covered that up😄

If you like the content, consider connecting with me and pour your knowledge into my D.M.!!😇

Instagram: bhavak_29

LinkedIn: https://www.linkedin.com/in/bhavak-kotak-3b6b071b1/

"Images belong to their respective owners."