Video walkthrough for some Web challenges from the NahamCon Capture the Flag (CTF) competition 2023 (organised by https://www.youtube.com/channel/UCCZDt7MuC3Hzs6IH4xODLBw ); Star Wars, Stickers, Hidden Figures and Obligatory. Topics covered include XSS, domPDF RCE, hidden data (misc/stego) and SSTI with WAF filter bypass. Write-ups/tutorials aimed at beginners - Hope you enjoy 🙂 #NahamCon #NahamCon2023 #NahamConCTF #CTF #Pentesting #OffSec #WebSec If you're looking for the "Marmalade 5" Web challenge, check the https://www.youtube.com/channel/UCcBgAEHAW0ESGwfoLJYg_Tg channel: https://www.youtube.com/watch?v=3LRZsnSyDrQ 🥰 Full write-ups for the challenges: https://github.com/Crypto-Cat/CTF/tree/main/ctf_events/nahamcon_23 ↢Social Media↣ Twitter: https://twitter.com/_CryptoCat GitHub: https://github.com/Crypto-Cat/CTF HackTheBox: https://app.hackthebox.eu/profile/11897 LinkedIn: https://www.linkedin.com/in/cryptocat Reddit: https://www.reddit.com/user/_CryptoCat23 YouTube: null Twitch: https://www.twitch.tv/cryptocat23 ↢NahamConCTF↣ https://ctf.nahamcon.com/challenges https://discord.gg/8MSu7KujqR ↢Resources↣ Ghidra: https://ghidra-sre.org/CheatSheet.html Volatility: https://github.com/volatilityfoundation/volatility/wiki/Linux PwnTools: https://github.com/Gallopsled/pwntools-tutorial CyberChef: https://gchq.github.io/CyberChef DCode: https://www.dcode.fr/en HackTricks: https://book.hacktricks.xyz/pentesting-methodology CTF Tools: https://github.com/apsdehal/awesome-ctf Forensics: https://cugu.github.io/awesome-forensics Decompile Code: https://www.decompiler.com/ Run Code: https://tio.run/ ↢Chapters↣ 0:00 Start 0:18 Star Wars (XSS) 4:07 Stickers (domPDF RCE via ttf/php polyglot) 11:45 Hidden Figures (Hidden data/embedded files) 17:55 Obligatory (SSTI + WAF) 25:26 End