The flag is somewhere on this web application not necessarily on the website. Find it.
🎯 Challenge Files & Infrastructure
Provided Files
1
Files:None
🔍 Initial Analysis
First Steps
Initially, the website appears as follows:
Site Presentation
The first thing I did was not inspect the page source this time, but I directly checked /robots.txt given the challenge title *Roboto* Sans:
Robots
It appears to be a site built with WordPress due to the Disallow: /wp-admin/, where /wp-admin/ is the default route to access the WordPress admin panel. There’s also a suspicious base64 encoding, let’s proceed with the exploitation.
🎯 Solution Path
Exploitation Steps
Initial setup
The first thing I did was decode those two base64 strings:
1
echo;echoanMvbXlmaWxlLnR4dA==| base64 -d
Base64 Decode
I directly used the second one, as the first one doesn’t seem to be a valid base64 string.
Exploitation
By trying to visit the route /js/myfile.txt (suggested by the decoded base64), I found the flag.
Flag capture
Manual Flag
🛠️ Exploitation Process
Approach
The automatic exploit simply makes a GET request to js/myfile.txt and extracts the flag from the response, printing it.
