At first glance, there was nothing interesting, so I decided to inspect the code using ChromeDevTools:
Page Source
As we can see, this is a challenge designed as a password checker. There is a verify function that checks if the correct flag is entered. Reconstructing the flag isn’t difficult. Let’s move on to the exploit.
🎯 Solution Path
Exploitation Steps
Initial setup
Once I understood how the function worked, it took parts of the flag, split into chunks of four characters, and combined them using an index, applying an offset of 4 defined by the variable split.
Exploitation
I simply took the position defined by split*number and composed the flag piece by piece. After trying to validate it, I received a valid response, and as a result, I knew that the flag was correct.
Flag capture
Manual Flag
🛠️ Exploitation Process
Approach
The exploit extracts the flag pieces using a regex from the response of a GET request, and then assembles it using the same logic applied in the JavaScript script.
