# Anonymous Challenge Write-Up: WinjaCTF c0c0n 2021

URL: https://krash.dev/posts/winja-anonymous-challenge-writeup/
Published: 2021-11-15
Tags: offensive-security, ctf-writeup, forensics, browser-forensics, digital-forensics, winjactf


WinjaCTF at c0c0n [2021]: I developed an easy challenge - called "Anonymous" - the challenge was based upon browser forensics.

## TL;DR 
**Intended Way** - Download the zip > Extract it > Navigate the Linux directory structure > To find a directory called `.config` > google-chrome > Default > Open the History File in SQL Browser > Search for URLs and upon up the URL to get a file with the name - formatted like flag.

**Un-Intended Ways** - Too Many 😂

## Detailed WriteUp

Download the ZIP and from the description it is obvious that it's a forensics challenge.
![Zipped File](https://krash.dev/posts/images/2021-11-15_03h44_15.png)

Navigate to `/home/crazy_crocodile/.config/google-chrome/Default/` and Open the "History" file in SQLite Browser.
> Note: `.config/google-chrome/Default/` contains all the chrome relatead artifacts

![SQLite Browser ScreenShot](https://krash.dev/posts/images/2021-11-26_11h46_34.png)

Click on the Browse Data Tab > Change the Table Dropdown to urls
![urls Menu](https://krash.dev/posts/images/2021-11-26_11h49_14.png)

Get the Drive URL or See the `Filter` tab to get the file name.
![flag-details](https://krash.dev/posts/images/2021-11-26_11h55_11.png)

Final Flag: 
```
flag{LJryyYW8IbxuZrOcZ4nd-this-is-a-challenge}
```

Thanks for playing Winja CTF 2020!