Just a Blog by Sharkkcode ... 紀錄，也是一種享受生活的方式 XD

Created2026-11-05|Updated2026-11-05|ARG

入口：https://sichengnews.tw.solve.quest/article.html?id=20070604-001 拿到入口 URL，看 source 載了什麼。 curl -s 'https://sichengnews.tw.solve.quest/article.html?id=20070604-001' \ | grep -oP '<script[^>]*src="[^"]*"' <script src="slow-loader.js?v=e376583f5c73"<script src="header-video.js?v=d3c08c376696"<script src="site-config.js"<script src="articles.js?v=d1b3f98eee01"<script src="article-loader.js?v=39db4 ...

用有限狀態機解 LeetCode 65 Valid Number

Created2026-10-25|Updated2026-10-25|LeetCode

題目 https://leetcode.com/problems/valid-number/description/ Given a string s, return whether s is a valid number. For example, all the following are valid numbers: "2", "0089", "-0.1", "+3.14", "4.", "-.9", "2e10", "-90E3", "3e+7", "+6e-1", "53.5e93", "-123.456e789", while the following are not valid numbers: "abc", "1a", "1e", "e3", "99e2.5", "--6", "-+3", "95a54e53". Formally, a valid number is defined using one of the following definitions: An integer number followed by an optional exponent. ...

HTB Titanic

Created2026-10-22|Updated2026-10-22|Hack The Box

題目： https://app.hackthebox.com/machines/Titanic 靶機的 IP 以下統一用 HTB_TARGET_IP 代表 ( 每次 spawn 都不一樣，請自行代換 ) 。目標：拿到靶機上的 user.txt 和 root.txt 的內容。靶機已退役 ( 2025/02/15 release ，難度 Easy ，Linux ) ，本文僅供教育與學習用途，請勿將文中技術用於未經授權的系統，文中也不會貼出 flag 內容。 nmap 掃描 HTB_TARGET_IP sudo nmap -sSCV -A -Pn HTB_TARGET_IP 大致結果： PORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)80/tcp open http Apache httpd 2.4.52|_http-server-header: Apache/2.4.52 (Ubuntu)|_htt ...

HTB LinkVortex

Created2026-10-22|Updated2026-10-22|Hack The Box

題目： https://app.hackthebox.com/machines/LinkVortex 靶機的 IP 以下統一用 HTB_TARGET_IP 代表 ( 每次 spawn 都不一樣，請自行代換 ) 。目標：拿到靶機上的 user.txt 和 root.txt 的內容。靶機已退役 ( 2024/12/07 release ，難度 Easy ) ，本文僅供教育與學習用途，請勿將文中技術用於未經授權的系統，文中也不會貼出 flag 內容。 nmap 掃描 HTB_TARGET_IP sudo nmap -sSCV -Pn HTB_TARGET_IP -sS 代表 SYN 掃描 ( 不進行完整的三次握手 ) 。 -sC 代表執行內建的預設腳本掃描。 -sV 代表服務版本探測。 -Pn 代表 no ping mode ( 適用於目標封鎖 ICMP 或防火牆過濾 ping 的情況 ) 。大致結果： 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)80 ...

溪埕

Created2026-09-26|Updated2026-09-26|ARG

我想要自己也可以玩，所以不想玩恐怖的... 最近突然看到很多形形色色的解謎遊戲網站，可能是 AI 很方便，大家更容易把自己的想法做出成果。有天在我跟朋友分享一個我不敢自己玩的微恐怖解謎網站遊戲後，朋友推給我另一個適合我自己玩不恐怖的，它是溪埕國民小學失蹤事件，我第一個反應是：「ㄟ？這次網址不是 xxx.github.io 了🤣 來玩一下好了！」我的解題過程 ( 有劇透，所以建議想要有遊戲體驗的先不要看！ ) 話雖如此，但我還是覺得我的遊戲體驗也不多？應該說我覺得我沒有很融入故事的內容🫠 即便看過很多類似的網站，但是這個算是我第一個認真想要解的，可能之後想要跟朋友炫耀吧... 言歸正傳，一開始最大的難題就是：我根本不知道怎麼樣算開始怎麼樣算結束！只是感覺像是要找到這個網站背後想要闡述的故事？然後可能會有一個「最終之地」代表我結束遊戲或通關之類的？總之，我就以這種什麼都不懂的狀態開始亂逛網頁了👍 整體網頁是傳統的網頁，連結多到有點想要直接寫個爬蟲開始掃，但是我先用我直覺點了留言板，好巧不巧就看到了一行「 1742 本留言暫不顯示」。再用直覺看了 page source ，誤 ...

OSINT Exercise 011 walkthrough

Created2025-05-21|Updated2025-05-21|OSINT

OSINT Exercise 011 解題紀錄任務 https://gralhix.com/list-of-osint-exercises/osint-exercise-011/ 任務要求：找出圖中四位人物的名稱。這題我找剝殼雞蛋跟我一起解，原先是想要比誰先解出來，但是因為太難所以決定合作🥺 我們的解題過程首先先放個我們看完題目後的心理狀態：單看圖片沒有什麼頭緒，先用圖片搜尋來看有沒有其他的線索。找到 As Libyan parties delay naming unity government, UN urges steps to end political divisions 這篇文章，其中有一張圖片幾乎與原圖如出一轍，圖片下方有註釋：「 Signing of the Libyan Political Agreement in Skhirat, Morocco, 17 December 2015. 」，到這邊我們可以推斷出幾件事情：知道照片拍攝於 2015/12/17 。影片中的人們應該正在簽署 Liby ...

Use Ghidra to find the offset of SSL_write() in the chrome.dll file from Chrome version 129.0.6668.71

Created2025-01-17|Updated2025-01-17

Use Ghidra to find the offset of SSL_write() in the chrome.dll file from Chrome version 129.0.6668.71 You need to first prepare Chrome version 129.0.6668.71 . SSL_write() is located in boringssl ( boringssl/ssl/ssl_lib.cc ) , a third-party library used by Chrome. Finding the location of SSL_write() in the source code first will help locate its offset in chrome.dll later. Search for the source code of boringssl/ssl/ssl_lib.cc Now, let's start looking for the source code of Chrome version 129.0.66 ...

Web Security Academy SQL injection Writeups

Created2024-09-05|Updated2024-09-13|Web Security Academy•SQL injection

This is my Web Security Academy SQL injection lab writeups. https://portswigger.net/web-security/sql-injection Lab: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data Description This lab contains a SQL injection vulnerability in the product category filter. When the user selects a category, the application carries out a SQL query like the following: SELECT * FROM products WHERE category = 'Gifts' AND released = 1 To solve the lab, perform a SQL injection ...

CSAW CTF Qualification Round 2024 Writeups

Created2024-09-13|Updated2024-09-13|CTF

CSAW CTF Qualification Round 2024 Writeups This is the writeup for my competition. It includes the solutions to the problems I solved during the contest, as well as some problems I managed to solve after the event. It's meant to share some of my thought processes, the techniques I learned, and the skills I acquired through solving these problems. Competition website link: https://ctf.csaw.io/ Backup of competition problems: https://github.com/osirislab/CSAW-CTF-2024-Quals INTRO Flag ( Ques ...

CVE-2024-6239

Created2024-08-31|Updated2024-08-31|CVE

CVE-2024-6239 This is my first CVE!!! I am preparing to share the process of how I discovered, explored, and submitted this CVE. The structure of this topic will be presented as a directory that reflects the entire process of vulnerability discovery and CVE application from start to finish. The process involves selecting a target project, narrowing down the scope, reviewing the source code (since the project I’m researching is open-source), conducting fuzzing tests on areas of interest, analyz ...