~$ Digital Overdose CTF Official Writeup #1 - Outage

Posted on Oct. 11th, 2021. | Est. reading time: 4 minutes

Tags: CTFWrite Up

This is the official developer writeup for the challenge ‘Outage - The usual suspect’ that was created for the Digital Overdose Autumn 2021 CTF.

The two other writeups published for this event are:

Summary

Challenge description and statistics

Challenge description on RACTF Challenge description on RACTF

The text reads:

Digital Overdose has a website, and you can access some information about it without really needing to visit, a bit like a phone book of sorts.

Find the flag :)

Out of the 63 correct submissions (first blood by pidnull), this challenge was rated 100% by all contestants.

Context

There is a quite a common meme nowadays when it comes to availability outages on the Internet, because it usually comes down to the same exact type of failure, most accurately summed up by:

Writeup

As such, the title was already enough for most people to solve the challenge. If the player was unaware of this though, that is where the description comes in: What data can you get about a website, without visiting it. Bonus points if it is “Like an address book”.

This question has a few simple answers:

  • WHOIS data
  • Page metadata
  • DNS records

When considering DNS, one needs to think about what type of records could be used to store information. The obvious response would be TXT records:

$ dig -t txt digitaloverdose.tech
; <<>> DiG 9.11.3-1ubuntu1.11-Ubuntu <<>> -t txt digitaloverdose.tech
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57034
;; flags: qr rd ad; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available


;; QUESTION SECTION:
;digitaloverdose.tech.          IN      TXT


;; ANSWER SECTION:
digitaloverdose.tech.   0       IN      TXT     "keybase-site-verification=YzZfhDKfOJdQ2b2Z_mMITYSzjQIN9Qd7dfYkQ5sz77k"
digitaloverdose.tech.   0       IN      TXT     "google-site-verification=qN3ndcZtU8mXrY_HbsDCQeSzel93DrZAWidDZ5Ol1gY"
digitaloverdose.tech.   0       IN      TXT     "DO{1T$_4LW4Y$_DN5}"
digitaloverdose.tech.   0       IN      TXT     "google-site-verification=SNWrpKpmjvLywAg9yOnJ7f5aCy7rqMvWQZwHyVEc7yE"
digitaloverdose.tech.   0       IN      TXT     "v=spf1 include:spf.efwd.registrar-servers.com ~all"

Huh, what’s that in line 15? It is a flag!

The flag is DO{1T$_4LW4Y$_DN5}