> For the complete documentation index, see [llms.txt](https://rayyanwong.gitbook.io/rayyan/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rayyanwong.gitbook.io/rayyan/ctfs/lag-n-crash-2022-march/lnc2022-writeups/seek-web-exploitation.md).

# Seek ( Web exploitation )

* Loaded into some webpage with only “submit query” can’t seem to input anything for SSTI or SQLi
* Went to burp suite and intercept when getting into website
* Realized that each time when pressing “submit query” it redirects to /ahhhhhhhhhhhhh
* POST and GET back a response? (not rly sure)
* ![](https://lh3.googleusercontent.com/bIh-CoaMIWz_V3aKjxKcJ2dOwW3uGsggGHpm4myqY3fDR_2sX-ewCCssn2KaPGiGOqHiCbI1wKcJyHlkRm1fUozOxIOpMY1U8RWY1Dwa0DLq6tR7drrMbs7RsrjrL2_95uLtQF3t) From actions
* Went into Target and Site map
* Looked through each METHOD for the website
* Saw a token that looks like hex text

![](https://lh6.googleusercontent.com/4AXq9_aKb7tJ5mWS3RRhfgbfL-cllc3RHHSrE-JrFBhpWF8dGyS3AeOS-pYn3V8FQkt3AWCDj2TLk_Jg__Nfd7i1BulEwD0W4FACyyGcXfwsYxCv_Bp60aOvwnIIf2IOOSBFlLoN)

* Took it to cyberchef and decoded it for flag :doughnut:

<mark style="color:blue;">**`LNC2022{s33k_4nd_s0ught_4ft3r}`**</mark>