> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2025/web-exploitation/pachinko-medium.md).

# Pachinko (Medium)

### Context

This is my first official Web Exploitation in where there wasn't like an injection. I've heard the best way to start these kind of challenges is to "Always begin by mapping the site using a proxy." Hence, I started to use Burp Suite. 

<figure><img src="/files/3fSsl7IEIoWmvY8l6i6t" alt="" width="534"><figcaption></figcaption></figure>

<figure><img src="/files/s77IrE9XyCw1vboHDXhj" alt=""><figcaption></figcaption></figure>

### Learning Burp Suite&#x20;

Prior to this CTF, I have used a bit of Burp Suite before. I knew we would first head over to the proxy tab and intercept the traffic between the website, but that's all I really knew.

<figure><img src="/files/fVNyUVvodvUkZUvMP0tA" alt=""><figcaption></figcaption></figure>

An issue I encountered was that when I tried to load up the website from PicoCTF, it wouldn't load. I had intercept on and only then I realized I needed to turn it off. By turning on "Intercept on" it meant that Burp would halt every request before it reaches the internet. To move foward, you would quite literally move foward using the red button, or even better, turn off intercept. That's why all the queries are shown, it needs your permission to move on!

<figure><img src="/files/iNKH6r8gLWkCMlLhnlUb" alt=""><figcaption></figcaption></figure>

Once I got to this stage, I just did a lot of playing around to see if there was any web requests. I noticed every time I submitted something, it sent out a POST request.&#x20;

<figure><img src="/files/22GdaNmgjcAzKECBy3jG" alt=""><figcaption></figcaption></figure>

From the screenshot, there has to be something with JSON files, and potentially encoding. One thing we know about JSON vulnerabilities that is is vulnerable to fuzzing.&#x20;

<figure><img src="/files/H9BRVVP1rN5XgroUEwMX" alt=""><figcaption></figcaption></figure>

Hence we'll need to hop on over to the Intruder tab of Burp Suite. But before doing anything, let's understand what really is the Intruder tab. The Intruder tab is mainly used to brute force logins, fuzz parameters, and bypass input validation.

> Burp Intruder is a tool for automating customized attacks against web applications. It enables you to configure attacks that send the same HTTP request over and over again, inserting different payloads into predefined positions each time

The intruder tab doesn't really 'hack', it just sends HTTP requests to the website, and replacing parts of the requests with different values. You'll know when you're correct when you get a 200 server code or something different.&#x20;

<figure><img src="/files/w4IbvdC2uQs0aLYhezy3" alt=""><figcaption></figcaption></figure>

To start intruder, you'll need to specify a Payload. I searched online and a number 0-100 would just work. Next, is to add your payload position. This is the part where you want to press the "Add" button on the top left to specify where. In my case, it didn't work (obviously) I'm going need to tinker around a bit more to see what I should put in "circuit".&#x20;

<figure><img src="/files/pPXWdJTUGtoVyd53D2fs" alt=""><figcaption></figcaption></figure>

I tried to be more nuanced with the way I organized the circuits, and I got more. Using this, I know we have to fuzz the numbers itself. I copied it over and pressed Auto.&#x20;

<figure><img src="/files/prwv0dLmtr6ZXxSvbfma" alt=""><figcaption></figcaption></figure>

Using this, I then ran it.

<figure><img src="/files/GiwNQxpRF1wDX56wWpFZ" alt=""><figcaption></figcaption></figure>

If you scroll down enough, you'll find it in the response tab!&#x20;