20250216 ‐ PicoCtf! - rundas-r00t/blog GitHub Wiki

https://rumble.com/v6lk3cy-sans-2024-holiday-hack-is-over-time-for-some-picoctf.html

OBS did not pick up my mic, so unfortunately there's no audio to this stream.

worked 4 intro flags, which were not very difficult. the first was viewing page source, taking a base64 string, and decoding it to produce the flag. the second was very similar, scanning each page's source until the flag was found; this time not encoded. the third was again, just r-click-->view source, and the flag was visible immediately. the fourth was still using Dev Tools and scouring javascript nodes to find a plain-text password in the source, using that user/pass combination, and finding the flag. this one was a bit tricky, as i wanted to crack a hash, but hashcat couldn't decide on which algorithm was correct. ChatGPT said it was MD5, but even after finding the plain-text password in the secure.js node, i could not reproduce the hash.

steps for flag #4:

• open up dev tools.
• fail the log-in
• dev tools will now see a secure.js node in the tree.
• click on this node to see the plaintext password hardcoded into the js
• use this user/pass combo to log-in and get the flag

screenshot spoilers:

Spoiler Alert

using admin:strongPassword098765 yields the flag: