Hey guys, I created a flag fetcher using some web stacks & technologies. It was supposed to fetch the flag.webp image file which contains the flag but there was some kind of error in doing that. Can you verify it? Maybe just get the flag I don’t really care if you fix it or not.
This should’ve worked
🎯 Challenge Files & Infrastructure
Provided Files
1
Files:None
🔍 Initial Analysis
First Steps
Initially, the website appears as follows:
Site Presentation
After a while of Loading..., the file http://34.131.133.224/flag.webp is loaded.
flag.webp
Let’s move on to the exploitation.
🎯 Solution Path
Exploitation Steps
Initial setup
Using WebDevTools, I noticed that the js included in the page makes fetch requests, gradually forming the flag with each fetch.
Fetch
And from here, it’s already possible to manually extract the flag.
Exploitation
Looking at the console:
Console
I found the lines of code where the fetch routes were contained, from which I was able to extract and manually assemble the flag.
Flag capture
Manual Flag
🛠️ Exploitation Process
Approach
The automatic exploit makes a GET request to index--6xk1IdU.js, extracts the text, and uses a regex to extract the flag and print it.
