While inspecting the page source, I found the function send_request():
Page Source
This function makes a request to /flag, sending a parameter input=... (which is the parameter seen in the input box from the image Site Presentation) and extracts the response (which will be the flag, inserting it into an alert). There’s also a comment:
1
// ^p.....F!?
I think it’s pretty clear… Let’s move on to the exploitation.
🎯 Solution Path
Exploitation Steps
Initial setup
In this challenge, we need to match a regex. A regular expression (often abbreviated as regexp, regex, or RE) is a sequence of symbols (a string) that defines a set of strings. Let’s move on to the next phase.
Exploitation
The pattern from the comment seems to resemble the format of picoCTF flags. In fact, by entering picoCTF in the input box, it will match the regex and return the flag in an alert(). As we can see, by using https://regex101.com/ (a useful online tool to analyze regex), inserting the regex from the comment and typing picoCTF in the section below, we get a match:
Regex 101
Flag capture
Manual Flag
🛠️ Exploitation Process
Approach
The exploit simply sends a GET request to /flag?input=picoCTF and extracts the flag from the response using a regex.
