TimeType

TimeType is a typing test featuring a replay functionality. Allowing users to test their typing speed and accuracy, and to replay their typing sessions.

For more detailed documentation see: docs

---

Features

• Typing Test: Measure your typing speed and accuracy.
• Replay Functionality: Review and analyze your typing sessions.
• Custom Text Upload: Upload your own text to create personalized typing tests.
• Explore Different Eras: Travel through various historical periods, each featuring unique texts that reflect the language and style of their time.
• Multiplayer: Play against your friends

---

Flagstores and Vulnerabilities

Flagstore 1: Replay

• Functionality: Stores and manages typing session replays.
• Vulnerability:
  • Insecure UUID Generation:
    Uses System.Random (which relies on splitmix) for UUID generation.
    System.Random is not cryptographically secure. This allows attackers to predict UUIDs, leading to unauthorized access to other users replays.

Flagstore 2: Custom Text Upload

• Functionality: Allows users to upload custom texts.
• Vulnerability:
  • Path Traversal:
    Due to missing sanitization of slashes, a logic flaw, and weird behavior of </>, attackers can upload files with names like //data/uploads/<username>/<filename> to access other peoples texts.

Flagstore 3: Private Lobby Chat

• Functionality: Users can create private password protected Lobbys.
• Vulnerability:
  • Missing auth check:
    The HTTP endpoint checks if the user has the needed auth session cookies for joining the lobby, the WS endpoint is missing these checks.

---

License

MIT License