cscg24-nothing

CSCG 2024 Challenge 'Nothing To See Here'
git clone https://git.sinitax.com/sinitax/cscg24-nothing
Log | Files | Refs | sfeed.txt

notes (1223B)


      1Check events api:
      2https://api.github.com/repos/VoidCollective/TheGreatNothing/events
      3=> shows create 2 events; one for the repo and one for main branch
      4
      5There are no commits:
      6https://api.github.com/repos/VoidCollective/TheGreatNothing/commits
      7
      8Looking around the api we find:
      9https://api.github.com/repos/VoidCollective/TheGreatNothing/git/refs
     10Shows a single ref with blob and ref atomic/origin
     11
     12take that blob and decode -> flag
     13
     14but why atomic/origin?
     15
     16heres a nice one-liner to try check out api endpoint with timeout:
     17curl https://api.github.com/repos/VoidCollective/TheGreatNothing
     18	| jq 'with_entries(select(.key | endswith("_url"))) | .[] | select(type == "string")'
     19	| cut -d{ -f1 | xargs -I{} -- "sleep 5 && curl -L {}"
     20
     21beware you run into the api limit very quickly
     22
     23looks like it was uploaded with the blobs api:
     24https://docs.github.com/en/rest/git/blobs?apiVersion=2022-11-28
     25
     26so what was the idea behind:?
     27A friend of mine keeps nagging me to stop using GUI git tools. Tells me I am missing something...
     28He set up this repo to prove it. But it is empty: https://github.com/VoidCollective/TheGreatNothing
     29
     30maybe that the gui will create a git event and if you use the api directly you can
     31create one without?