CTF Day 23 | North-South | Crack the Gate 2

1. North-South

This CTF involves changing the location to get the flag. After launching the instance, we got two links: one is to get the flag, and another is the configuration file.

I opened the configuration file using the cat command. I saw that to get the flag, my current location should be the country code IS, which is Iceland. Otherwise, the traffic will pass from the north.

    upstream north {
        server 127.0.0.1:8000;
    }

    upstream south {
        server 127.0.0.1:9000;
    }

    server {
        listen 80;

        location / {
            if ($geoip2_data_country_code = IS) {
                proxy_pass http://south;
            }

            proxy_pass http://north;
        }

    upstream north {
        server 127.0.0.1:8000;
    }

    upstream south {
        server 127.0.0.1:9000;
    }

    server {
        listen 80;

        location / {
            if ($geoip2_data_country_code = IS) {
                proxy_pass http://south;
            }

            proxy_pass http://north;
        }

To change my current location, I used Urban VPN as a Chrome extension.

After connecting to the VPN, I tried to connect to the flag website, and it revealed the flag.

2. Crack the Gate 2

After reading the statement, I got to know that a server is blocking multiple attempts at login based on the IP address. I was given a list of passwords and email id; I needed to log in and capture the flag. To prevent being blocked, I need to use X-Forwarded-For in the HTTP header in my request to change my IP Address.

Let's solve this challenge. I launched the Burpsuite for making these changes in the header of the request.

I downloaded the password list using the wget command. There are a limited no. of passwords in this list; we can change them manually to test it.

I visited the website; I got a login page.

I entered the email given in the challenge and the password from the password list and clicked on login. Before clicking on login, I had turned on interception in Burp Suite. I captured the request and forwarded it in the Repeater.

I tried too many times, so the server blocked me with a message: Too many failed attempts.

Now I used X-Forwarded-For to change the IP address. After adding it to the header, I am able to log in again.

After trying for some time, I get the correct password. I got the flag.

Key takeaways:

🌍 Understanding how geolocation can influence application behavior 🛡️ Using VPNs to test location-based access controls 🛠️ Analyzing and modifying HTTP requests with Burp Suite 🌐 Understanding the role of the X-Forwarded-For header 🔐 Exploring how weak IP-based rate limiting can be bypassed

Small learnings every day will become an ocean one day.