Convert images to webp and update references

_posts/2024-09-09-csaw-bucketwars.md

@@ -17,16 +17,16 @@ The hardest challenge for a CTFer to solve is how to lose their versionity.
 
 No source code? No problem. Let's take a look at this website.
 
-![A webpage with a photo of a bucket and a caption.](/assets/csaw/kyleburgess2025/homepage.png)
+![A webpage with a photo of a bucket and a caption.](/assets/csaw/kyleburgess2025/homepage.webp)
 *Wow. Very philosophical.*
 
 The BucketWars website is very, very, very simple. We can see a photo of a bucket with some feaux-poetic musings along with a version label. We can also navigate to `/versions` to see a list of previous versions, from `v1` to `v5`. Clicking on the version brings you to `/index_v#.html`, each of which is a slightly different website... nothing of note here. Of course, my pattern-recognizing ass immediately got cheeky with it and tried `/index_v6.html` to see if anything appeared. 
 
-![Just a lousy 404 page.](/assets/csaw/kyleburgess2025/404.png)
+![Just a lousy 404 page.](/assets/csaw/kyleburgess2025/404.webp)
 
 Man, just a 404 page... but an INTERESTING 404 page! First off, we can glean that the website is hosted on an AWS S3 bucket somewhere in the cloud. We can tell by the domain name that the bucket name is `bucketwars.ctf.csaw.io`. We also see a link to what should have been the 404 page. Opening the URL gives us this: 
 
-![Three Kermits doing the see no evil hear no evil speak no evil pose.](/assets/csaw/kyleburgess2025/kermit.png)
+![Three Kermits doing the see no evil hear no evil speak no evil pose.](/assets/csaw/kyleburgess2025/kermit.webp)
 
 ## Messing Around
 
@@ -36,11 +36,11 @@ As a long-time AWSer, I definitely knew about the cloud shell inside the AWS web
 
 As I stood in the shower, I kept repeating to myself, "Versioning... S3... Versioning..." until I eventually hit "woah... S3 versioning!" S3 allows you to enable versioning on your files, which keeps track of all past versions of a file for you. You can see the version history by using the `aws s3api list-object-versions` command. Running `aws s3api list-object-versions --bucket` gave me...
 
-![Versions of files!!!](/assets/csaw/kyleburgess2025/versions.png)
+![Versions of files!!!](/assets/csaw/kyleburgess2025/versions.webp)
 
 Woah!! I was suddenly able to see all of the previous versions of files. I tested each one by navigating to `https:bucketwars.ctf.csaw.io.s3.amazonaws.com/path/to/file?versionId=VERSION_ID`. A bunch were nonsense, but a few on `index_v1.html` seemed to be leading somewhere, until I reached `https://bucketwars.ctf.csaw.io.s3.amazonaws.com/index_v1.html?versionId=t6G6A20JCaF5nzz6KuJR6Pj1zePOLAdB`:
 
-![A weirdly high-res photo of a bucket.](/assets/csaw/kyleburgess2025/suspicious-bucket.png)
+![A weirdly high-res photo of a bucket.](/assets/csaw/kyleburgess2025/suspicious-bucket.webp)
 *A weirdly high-res photo of a bucket.*
 
 At first, I thought this was just some more nonsense, but stegonography run by Patryk using Aperi'Solve revealed the flag:

_posts/2024-09-09-csaw-lost-pyramid.md

@@ -17,12 +17,12 @@ The only way to avoid SSTIs is to use protection.
 
 In this problem, we are able to navigate through a pyramid through a website. The goal is to access the King's Lair without being turned away by the king. The king will only allow you in if your JWT token (stored in a cookie) states that you are royalty and that you are approaching on the King's Day.
 
-![A photo of the inside of a pyramid.](/assets/csaw/kyleburgess2025/pyramid.png)
+![A photo of the inside of a pyramid.](/assets/csaw/kyleburgess2025/pyramid.webp)
 *This 1000 sqft ranch-style home has an open floor plan, unique architecture, and whispering coming from the walls!*
 
 Lovely. There are a few other rooms, the most notable of which allows you to provide your name, which is then rendered on the screen. Suspicious...
 
-![A photo of a pyramid with text across the top.](/assets/csaw/kyleburgess2025/scarab.png)
+![A photo of a pyramid with text across the top.](/assets/csaw/kyleburgess2025/scarab.webp)
 *This seems normal. I'm sure this has nothing to do with the challenge.*
 
 ## My Approach
@@ -69,7 +69,7 @@ Do you see that? `**globals()`. This passes all global variables into the contex
 Payload: `{{KINGSDAY}}𓁹{{PUBLICKEY}}`:
 
 Result:
-![A photo of the inside of a pyramid with the public key and the kingsday written on it.](/assets/csaw/kyleburgess2025/scarab_key.png)
+![A photo of the inside of a pyramid with the public key and the kingsday written on it.](/assets/csaw/kyleburgess2025/scarab_key.webp)
 *What a beautiful name for a baby boy.*
 
 Ok, let's put it all together. I wrote this lovely encoding function that created the token we need:
@@ -89,6 +89,6 @@ def encode():
 
 I set the `pyramid` cookie to be equal to this token and proceeded to the King's Lair:
 
-![Gold! Gold!!!](/assets/csaw/kyleburgess2025/pyramid_flag.png)
+![Gold! Gold!!!](/assets/csaw/kyleburgess2025/pyramid_flag.webp)
 
 Done. QED. Bam.