CTF Write-Ups

Skip to main content

Search This Blog

CTF Write-Ups

Posted by Kevin Pagano

Get link
Facebook
X
Pinterest
Email
Other Apps

Here is a collected list of all of the write-ups I've done for CTFs.

2025

Magnet Virtual Summit

Android Takeout

Chromebook Takeout

2024

Magnet Virtual Summit

2023

Cellebrite

NahamCon

Magnet User Summit

Android (Part 1)

Android (Part 2)

Magnet Virtual Summit

2022

Magnet User Summit

Cellebrite CTF

Heisenberg's Android

Marsha's iPhone

Magnet Virtual Summit

BloomCON 0X06

Belkasoft CTF March

2021

Cellebrite CTF

Heisenberg's Android

Marsha's iPhone

Marsha's iTunes Backup

Magnet Virtual Summit

Belkasoft CTF March

BloomCON 0x05

Networks - Who Am I? (Challenge 1)

Networks - Exfiltration Investigation (Challenge 2)

2020

Magnet Weekly CTF

Android

Week 1 - Hosts File

Week 2 - Chrome Artifacts

Week 3 - Motion Photos

Week 4 - Evernote GUIDs

Linux

Week 5 - Hadoop Logs

Week 6 - Error Codes

Week 7 - IP Interfaces

Week 8 - PHP Cluster

Memory

Grand Prize

Magnet Virtual Summit

2019

Magnet User Summit

2018

Magnet User Summit

Misc

Get link
Facebook
X
Pinterest
Email
Other Apps

Archive

April 20252
March 20259
February 20251
January 20252
December 20242
October 20241
May 20241
April 20242
March 20244
February 20241

Show more Show less

Popular Posts

StartMe Up (Forensic Edition)

As part of my own benefit I created a Start.Me page for a bunch of FOSS forensic tools and utilities that I currently have in my toolkit. I've also included RSS feeds for blogs I follow as well as YouTube channels and some other links to sites I frequent. You can access it at startme.stark4n6.com or preview it below (embedding on Blogger isn't the best). If anyone has suggestions on more items to add or links please feel free to reach out to me on Twitter @KevinPagano3 . *Cues The Rolling Stones*

Cellebrite CTF 2021 - Heisenberg's Android

Cellebrite is back with another CTF competition and this year's takes it up a notch. I want to start by giving major props to Heather, Paul, Ronen, Sahil and Ian for putting on a great competition . Now lets get started with the walkthroughs. First up, is the Samsung Note 10 owned by "Heisenberg". Evidence : https://d17k3c8pvtyk2s.cloudfront.net/CTF21/CTF21_Heisenberg_SM-N970U1_QualcommLive_2021-07-22.zip Password : 02DB2ECE91DB67E8FA939FC3DC15D16B Device Identification (10 points) What is the Bluetooth MAC Address of the first vehicle Heisenberg's Android connected to? Pulled from the file at the following path: Dump\data\misc\bluedroid\bt_config.conf We get bluetooth connections which we can easily see in the ALEAPP report below that the answer was " 34:C7:31:F8:61:3B ". Figure 1: Bluetooth connections report in ALEAPP Application Analysis (10 Points) Which website did Heisenburg look for guidance on how to mount a USB drive on his phone? (The answer sh...

Chrome Network Action Predictor, Preloading all your Webpages

One of the useful features Chrome has had for a long is text prediction. When you start to search for something Google attempts to predict what you are looking for. This works for not only keywords but also for previous URLs that you may have visited. Figure 1: Sample Google search with predictions The toggle for preloading webpages in the current build of Chrome (88) can be found under: Settings > Privacy and security > Cookies and other site data Figure 2: Preload pages toggle in Chrome Settings Well of course Google is tracking it all in a database. You can find it at the following path: Windows: C:\Users\<USERNAME>\Local\Google\Chrome\User Data\Default\Network Action Predictor Android: data\data\com.android.chrome\app_chrome\Default\Network Action Predictor We don't get specific timestamps on when a hit was registered but we do get insight into what the user was typing out to get to a specific keyword or search. We also get the amount of hits and misses that specifi...

© 2021 STARK 4N6

Powered by Blogger