With computers it’s always a step by step process. There is no magic. There is no cheating a way around something. Everything is a process. Figure out the process and get the data you wish.
Computers and the applications they run are meant to take input and produce output. That’s their job. Even with fancy names like AI or smart computing, everything they do is input produces output. Even errors. Especially errors.
Take a challenge at Hack the Box I was working on today.
The goal of the challenge is to get the info from a web page and submit it – and do it really fast. Faster than I can if I could do math. Faster than I could if I could do quick algorithms in my head. I’m learning it’s a pretty normal thing for a capture the flag or hacking challenge.
Doing it that fast means I can’t do it myself. I need to script it. Also being that it’s still live, I can’t really say what I did (even if only 3 people read this write up) but I can walk through my process – because a process will get the answer.
What data is it looking for? Look at the description and then the web page. Make a few deductions.
What am I going to use to script this? Me? Python. It’s down, dirty and quick. There are modules to connect to the web site and to do what it wants me to do to complete the task.
Now I said earlier there is a process to everything. That is true. That doesn’t mean there is only one way to do it though. I am choosing python because I know it and I know how to use to to get what I want. There are a myriad of other scripting languages that can do this too, which other people are more versed in – and can probably do it quicker and cleaner than I can, but this is my drug of choice.
Is there a pattern here that can help me out? What is it? How do I produce it and reproduce it?
Next Next Next
Where do they want the data once I get it? Cool. Cool. Cool. I see where they want it.
Next Next Next Next
Put it all together. This is the messy testing put in a lot of comments and make changes and remember to close parentheses portion of the program.
It’s also the part where I say, hey – this should work. Why isn’t it working? They did something wrong. But I know they didn’t do something wrong. It was me who forgot to run the data transformation function. Finally I got the session info in there and Voila! – the result I was looking for.
Plug it in and get a challenge owned.
Process found. Process followed. Process complete.
Now, plumbing, electricity, and how cars work… that’s magic!