This year I contributed 2 challenges to bi0s CTF (formerly InCTF Internationals). EmoLocker (Server-Side) PyCGI (Client-Side) In this post, we discuss the intended solution to PyCGI challenge. The source code of this challenge can be downloaded from here. # Analysis We are provided with 2 attachments for this challenge: Dockerfile Nginx.conf Looking into the Nginx configuration, we can find that there is a potential path traversal in the /static endpoint. You can read more about this here.

In this post, we discuss the solution to EmoLocker challenge from bi0s CTF 2022. The source code of this challenge can be downloaded from here. # Analysis Upon opening the challenge link, we are presented with a lockscreen that uses emojis instead of numbers. The page has two features: register and login. Additionally, there is an admin bot, which suggests that the challenge may involve client-side concepts. The frontend of this application is developed in React.