# Snyk Fetch the Flag CTF 2023 writeup: Silent Cartographer

DevFeed: [Snyk Fetch the Flag CTF 2023 writeup: Silent Cartographer](<https://devfeed.tech/articles/snyk-fetch-the-flag-ctf-2023-writeup-silent-cartographer-8132.md>)

Original publisher: [Read original article](<https://snyk.io/blog/snyk-fetch-the-flag-ctf-2023-writeup-silent-cartographer/>)

Author: John Hammond

Published: 2023-11-30T06:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [ctf](<https://devfeed.tech/topics/ctf.md>), [C2](<https://devfeed.tech/topics/c2.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>), [Server](<https://devfeed.tech/topics/server.md>)

Tags: [apis](<https://devfeed.tech/tags/apis.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [c2](<https://devfeed.tech/tags/c2.md>), [code](<https://devfeed.tech/tags/code.md>), [ctf](<https://devfeed.tech/tags/ctf.md>), [developer](<https://devfeed.tech/tags/developer.md>), [exploits](<https://devfeed.tech/tags/exploits.md>), [external](<https://devfeed.tech/tags/external.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>), [web](<https://devfeed.tech/tags/web.md>), [web-app](<https://devfeed.tech/tags/web-app.md>)

## AI overview

This Snyk writeup explains the solution to the Silent Cartographer challenge from the 2023 Fetch the Flag CTF. The challenge involves exploiting Covenant, a C2 web application, by forging a JWT with a default secret key, obtaining administrative access, modifying the exploit to use an available port, and handling the resulting reverse shell through a tunneling service.

## Source excerpt

If you were at Snyk's 2023 Fetch the Flag and are looking for the answer to the Silent Cartographer challenge, you've come to the right place. Let's walk through the solution together!