ctf-flag-hunting

CTF Flag Search Strategy

⛔ In-Depth Reference (Supplementary Reading)

• Complete search paths and commands → references/flag-search-paths.md
• This skill already includes the core search paths; references are for supplementing edge cases

---

Phase 1: Choose a Search Strategy Based on Privilege Type

你有什么权限？
├─ 命令执行（RCE）→ Phase 2
├─ 文件读取（LFI）→ Phase 3
├─ 数据库访问（SQLi）→ Phase 4
└─ Web 管理后台 → Phase 5

---

Phase 2: RCE — File System Search

Priority order (arranged by success rate):

2.1 Standard flag paths (try these first, all at once)

cat /flag.txt && cat /flag && cat /root/flag.txt && cat /home/*/flag.txt

2.2 Non-standard paths (after standard paths fail)

cat /var/www/html/flag.txt
cat /var/www/html/flag.php
cat /tmp/flag
cat /tmp/flag.txt
cat /opt/flag.txt
cat /app/flag.txt

You can also look at the filenames under the path

ls /root
ls /tmp

2.3 Full disk search (when the path is uncertain)

find / -name "flag*" 2>/dev/null
find / -name "*.txt" -path "*/flag*" 2>/dev/null
grep -r "flag{" / --include="*.txt" --include="*.php" --include="*.html" 2>/dev/null

2.4 Environment variables and processes

env | grep -i flag
cat /proc/self/environ | tr '\0' '\n' | grep -i flag
cat /proc/self/cmdline | tr '\0' '\n' | grep -i flag

2.5 Database configuration → query the database

cat /var/www/html/config.php    # 数据库连接凭据
cat /var/www/html/.env          # 环境变量泄露
cat /app/config.py

After finding database credentials:

mysql -u <user> -p<password> -e "SHOW DATABASES; USE <db>; SHOW TABLES; SELECT * FROM flag;"

2.6 Processes and network

ps aux | grep -i flag      # 进程命令行参数
netstat -tlnp              # 内网服务可能有 flag
lsof -i                    # 开放端口对应的服务

---

Phase 3: LFI — File Read Search

LFI is more limited than RCE — you can only read files, not execute commands.

When path traversing to find the flag, try multiple filename variants simultaneously at each depth:

# 每个深度都要批量测试这些变体（不要只试 flag 不试 flag.txt！）
../flag          ../flag.txt        ../.flag         ../flag.md
../../flag       ../../flag.txt     ../../.flag
../../../flag    ../../../flag.txt  ../../../.flag
# 同时测试绝对路径
/flag            /flag.txt          /root/flag.txt   /tmp/flag

⚠️ Common failure pattern: only trying ../flag while ignoring ../flag.txt, causing a timeout. Be sure to send variants both with and without the suffix at the same time.

Priority order:

1. Standard flag paths: for each depth (../、../../、../../../) try simultaneously flag、flag.txt、.flag、flag.md
2. Confirm readability：/etc/passwd can be read → indicates LFI works
3. Configuration files(to find more credentials):

   /var/www/html/config.php
   /var/www/html/.env
   /proc/self/environ
   /proc/self/mounts
   

4. Source code files：/var/www/html/index.php、/app/app.py — may reveal an RCE entry point
5. Log files：/var/log/apache2/access.log — log poisoning preparation

---

Phase 4: SQLi — Database Search

-- 1. 列出现有数据库
SHOW DATABASES;

-- 2. 切换后列出表
USE <db>;
SHOW TABLES;

-- 3. 直接查 flag 表
SELECT * FROM flag;
SELECT * FROM flags;
SELECT * FROM secret;
SELECT * FROM secret_table;

-- 4. 不知道表名时搜索
SELECT table_name, column_name FROM information_schema.columns WHERE column_name LIKE '%flag%';

-- 5. 读取文件（需要 FILE 权限）
SELECT LOAD_FILE('/flag.txt');

---

Phase 5: Web Admin Panel Search

1. Browse all pages — the flag may be on non-standard pages ("About", "Help", "Debug")
2. User-related fields — the flag may be hidden in notes, bio, email, description
3. System configuration pages — "System Information" "Server Status" may display the flag
4. File management/template editing — when files are writable, deploy a webshell directly
5. Source code comments — search for the flag string in HTML comments and JS comments

---

Phase 6: When the Flag Cannot Be Found

If you have tried all standard paths and still cannot find it, try the following fallback methods:

1. Switch extraction methods：
   • RCE blind injection: use time delays or DNS exfiltration to extract character by character
   • LFI combined with race conditions or PHP session inclusion
2. Expand the search scope：
   • Other database tables:SELECT * FROM users LIMIT 10; — the flag may be leaked in user data
   • Command history:history — previous operations may have left behind the flag path
3. Find other entry points：
   • Look through Jenkins/GitLab/admin panel — maybe the flag is publicly exposed there
   • Check the nginx/apache configuration file:/etc/nginx/sites-enabled/ — path mapping may leak
4. Use the hints in the challenge：
   • The challenge name often hints at the flag location (e.g., baby_pwn → pwn-type challenges)
   • Keywords in the description ("database", "source") point to the search direction

---

Flag format identification

• flag{hex_string} — most common, 32/40/64 characters
• flag{string}、CTF{string} — lowercase or other prefixes
• Plain string (the challenge will specify)

Fake flag traps：flag{test}、flag{this_is_not_the_flag} is a decoy.

---

Notes

• Verify before submitting: after obtaining the flag, use ctf-flag-verification to verify the format and length
• Judging fake flags: abnormal length/characters, very likely a decoy
• LFI: read the configuration first: the configuration file can tell you the database password; finding the flag from the database is more reliable than guessing paths
• RCE: check the database first: in many CTFs the flag is not in the filesystem, but in the database