Blog Post

Community Blog
2 MIN READ

The Human Connection Challenge: Season 1 Episode 6 Is Now Live!

TillyCorless's avatar
TillyCorless
Icon for Community Manager rankCommunity Manager
4 months ago

Things are heating up in The Human Connection Challenge! Can you test your skills with this Thick-Client Applications episode?

Welcome to the sixth instalment of the Human Connection Challenge: Season 1. This lab tests your ability to analyze and exploit Thick Client applications. As this is a challenge lab, you'll find limi...
Updated 4 months ago
Version 2.0
challenges
community challenge
TillyCorless's avatar
Icon for Community Manager rankCommunity Manager
Joined May 24, 2024
View Profile
Community Blog
Here you can read the Community Guidelines, Best Practice Guide and all the latest announcements from the Community Team.
seedrcc's avatar
seedrcc
Icon for Bronze I rankBronze I
4 months ago

Stuck on Q4. What tool to use to analyse the Application.

netcat's avatar
netcat
Icon for Silver III rankSilver III
3 months ago

If you're clueless like I am (I would have preferred ghidra and a x64-dbg, which - I'm 100% convinced - are just enough to solve the challenge. Functions like write_token, getToken etc. are there. Or try to extract all GIF and PNG images, but that road leads nowhere, too.), then you'll write a reverse proxy in python, and let the traffic flow via that reverse proxy. Or just use netcat to read the packets from the client, and then send them to the API, and then answer back. Since it's all http with text/ascii it can be done.
Pretty sure the official solution will be much simpler.

  • CyberSharpe's avatar
    CyberSharpe
    Icon for Silver I rankSilver I
    3 months ago

    Burpsuite is king here and all you need. 

    • netcat's avatar
      netcat
      Icon for Silver III rankSilver III
      3 months ago

      Oh yeah, burp is used in the official solution.