Blog Post

Community Blog
2 MIN READ

The Human Connection Challenge: Season 1 Episode 6 Is Now Live!

TillyCorless's avatar
TillyCorless
Icon for Community Manager rankCommunity Manager
25 days ago

Things are heating up in The Human Connection Challenge! Can you test your skills with this Thick-Client Applications episode?

Welcome to the sixth instalment of the Human Connection Challenge: Season 1. This lab tests your ability to analyze and exploit Thick Client applications. As this is a challenge lab, you'll find limi...
Updated 24 days ago
Version 2.0
challenges
community challenge
TillyCorless's avatar
Icon for Community Manager rankCommunity Manager
Joined May 24, 2024
View Profile
Community Blog
Here you can read the Community Guidelines, Best Practice Guide and all the latest announcements from the Community Team.
netcat's avatar
netcat
Icon for Silver I rankSilver I
7 days ago

If you're clueless like I am (I would have preferred ghidra and a x64-dbg, which - I'm 100% convinced - are just enough to solve the challenge. Functions like write_token, getToken etc. are there. Or try to extract all GIF and PNG images, but that road leads nowhere, too.), then you'll write a reverse proxy in python, and let the traffic flow via that reverse proxy. Or just use netcat to read the packets from the client, and then send them to the API, and then answer back. Since it's all http with text/ascii it can be done.
Pretty sure the official solution will be much simpler.

CyberSharpe's avatar
CyberSharpe
Icon for Bronze III rankBronze III
7 days ago

Burpsuite is king here and all you need. 

  • netcat's avatar
    netcat
    Icon for Silver I rankSilver I
    2 days ago

    Oh yeah, burp is used in the official solution.