initial commit
This commit is contained in:
antton committed
commit
109bb924dd
135 files changed
+2538
No files matched your search
@@ -0,0 +1,28 @@
|
||||
# Back to Basics
|
||||
|
||||
**Category:** Aurora Patient Zero
|
||||
|
||||
**Points:** 15
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/aurora_patient_zero.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@G2Gh0st\</code>\</sup>
|
||||
\<style>
|
||||
.tiny-text {
|
||||
font-size: 6px;
|
||||
color: #1a1a1a;
|
||||
}
|
||||
\</style>
|
||||
\<span class="tiny-text">flag{1_l0v3_AI}\</span>
|
||||
|
||||
|
||||
For this task, you need to continue your examination of the Aurora Patient Portal application.
|
||||
|
||||
Now we know how DEADFACE is able to collect all this information, but now we would like to deploy some network monitoring to ensure we know everything they are doing. There is a hidden diagnostic page built into the app. Using ALL the possible data that you were able to collect so far, see if you have search for the name of the gateway server the app is using to communicate back to Aurora's servers.
|
||||
|
||||
Submit the result as the flag. Use the format `deadface{gateway-name}`
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
@@ -0,0 +1,32 @@
|
||||
# Down the Rabbit Hole
|
||||
|
||||
**Category:** Aurora Patient Zero
|
||||
|
||||
**Points:** 10
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/aurora_patient_zero.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@G2Gh0st\</code>\</sup>
|
||||
\<style>
|
||||
.tiny-text {
|
||||
font-size: 6px;
|
||||
color: #1a1a1a;
|
||||
}
|
||||
\</style>
|
||||
\<span class="tiny-text">flag{1_l0v3_AI}\</span>
|
||||
|
||||
|
||||
For this task, you need to continue your examination of the Aurora Patient Portal application.
|
||||
|
||||
We know the application relies heavily on a unique Patient ID number for cross-reference throughout the application. Continue your analysis of the app environment to see if you can find a file hiding the Patient ID.
|
||||
|
||||
\> Hint: no emulator or debugging is required for this challenge.
|
||||
|
||||
**Use the same files from *Info Leaks***
|
||||
|
||||
Submit the flag as `deadface{ID}`.
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
Binary file not shown.
@@ -0,0 +1,33 @@
|
||||
# Info Leaks
|
||||
|
||||
**Category:** Aurora Patient Zero
|
||||
|
||||
**Points:** 25
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/aurora_patient_zero.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@G2Gh0st\</code>\</sup>
|
||||
\<style>
|
||||
.tiny-text {
|
||||
font-size: 6px;
|
||||
color: #1a1a1a;
|
||||
}
|
||||
\</style>
|
||||
\<span class="tiny-text">flag{1_l0v3_AI}\</span>
|
||||
|
||||
|
||||
Aurora Health has been dealing with a wave of highly targeted phishing attacks against its patients. The messages are convincing, contain accurate patient information, and are resulting in an alarming number of successful compromises.
|
||||
|
||||
Investigators have identified one common link among the victims: every affected patient recently installed Aurora Health's new Patient Portal iOS application. Security analysts suspect the app may be exposing sensitive information that DEADFACE is using to craft its phishing campaigns. We have been given a copy of the application for analysis. Fully evaluate the app and determine what information is being leaked so we can truly identify the source of the exposure before more patients fall victim to the attacks.
|
||||
|
||||
Your first task is to determine the patient's name and DOB for the patient that last used this specific version of the app. Submit the data as the flag in this format: `deadface{firstname-lastname-YYYY-MM-DD}`
|
||||
|
||||
\> Hint: no emulator or debugger is required for this challenge.
|
||||
|
||||
[Download File](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/mob/mob07/AuroraPatientPortal.ipa.zip) (2.5 MB)\<br>
|
||||
\<sup>SHA1: `b3b5f8b6492ccb082c1bc26fa2fdddd033b07072f96aca23a233beb731211bfa`\</sup>
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
@@ -0,0 +1,28 @@
|
||||
# SQL Skillz
|
||||
|
||||
**Category:** Aurora Patient Zero
|
||||
|
||||
**Points:** 50
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/aurora_patient_zero.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@G2Gh0st\</code>\</sup>
|
||||
\<style>
|
||||
.tiny-text {
|
||||
font-size: 6px;
|
||||
color: #1a1a1a;
|
||||
}
|
||||
\</style>
|
||||
\<span class="tiny-text">flag{1_l0v3_AI}\</span>
|
||||
|
||||
|
||||
For this task, you need to continue your examination of the Aurora Patient Portal application.
|
||||
|
||||
After completing *Info Leaks* and *Down the Rabbit Hole*, you have collected the patient data that is needed to query the application database file. Use the data collected to determine what medications the current patient is taking *other than Ibuprofen*.
|
||||
|
||||
Submit the result as the flag as `deadface{Name}`.
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
Reference in new issue
Block a user