Blog

ISSessions CTF 2021 Programming - NATO

Mar 31, 2021 | 2 minutes read

NATO

Phonetic Alphabet, convert to the “normal” representation and send back within 3 seconds.

Solution

Bash scripting for all these web requests was my method. I could manipulate the needed data, and handle it pretty quickly. Since all these web style programming challenges have the same page format, I can reuse it between them.

Lets break down the commands.

#!/bin/bash
data=$(curl -c cookies "http://prognato.ctf.issessions.ca/" | grep -oE "data\".*" | grep -oE ">.*<" | cut -c 2- | grep -oE "[^<]+" | tr -d '\n' | sed 's/\(.\)[^ ]* */\1/g' )
curl -b cookies "http://prognato.ctf.issessions.ca/index.php?answer=$data"
curl -c cookies "http://prognato.ctf.issessions.ca/"

Curl request, save cookies to the file: cookies.

grep -oE "data\".*"

Grep, search for the line that has data" in it, and select only that line. -E is to enable Regex mode, and -o is to select only the result.

grep -oE ">.*<"

Grep, select the inner contents of the HTML tags. We don’t know how many words are going to be here, so we want them all.

cut -c 2- | grep -oE "[^<]+"

I’ve tied these two together, because they both remove the angle brackets from each end, cut -c 2- removes the right, and grep -oE "[^<]+" selects every character except <.

tr -d '\n'

This one is a painful point - I kept troubleshooting it and it wasn’t working the way I wanted. Turns out grep prints a newline with its output. Rookie mistake. This deletes the newline.

sed 's/\(.\)[^ ]* */\1/g'

REGEX for the win! Let’s break this one down a bit more. 's/\(.\)[^ ]* */\1/g' is the sed syntax to find and replace using PCRE (Perl Compatible Regular Expressions). The regex does the following:

\(.\)[^ ]* *: Select any character set that does not contain a space, aka, a “word”, and the following space. There’s a faster way to select a word, via \w, but make special note of \(.\). This is group syntax. It means that you can refer to it later on, which will be important. \1: Replace what was found, with the first group match. In this case, the first group match was the first character of the word. Since NATO/phonetic alphabet relies on the first letter of the word as the intended word, This will leave the character, and nothing else from the word.