Fetch the Flag CTF 2022 writeup: Moongoose

Snyk’s 2022 Fetch the Flag CTF challenge “Moongoose” required participants to combine directory traversal, JavaScript prototype behavior, and MongoDB injection techniques to retrieve a flag from a deliberately vulnerable Node.js application. Investigation of the login page and network traffic revealed an Express server whose image endpoint allowed directory traversal, enabling access to package.json and server.js and confirming use of Mongoose and MongoDB. Source-code review showed that authentication depended on a bcrypt-protected password but validated session tokens through a plain JavaScript object, allowing inherited properties such as “toString” to bypass the token check. The protected flag endpoint accepted an unsanitized value in a MongoDB query, so a $ne null injection paired with the prototype-based authentication bypass returned all flag records.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.