Register on the platfrom and spawn the instances accordingly.
Author: Abhinav @.0_0.ace.0_0.
Starting off the challenge the website asks us to input 2 parameters to check their love level but weirdly the parameters were called in such way that its supposed to be used for login like theres a parameter for a username and for a password
so suspecting it was using a login backend but without checking for usernames and passwords possibly just ignoring the backend but still using it i suspect it of containing a sqli vulnerability so i first tried doing ' but nothing was wrong but then i was thinking how can i extract more data so i tried UNION SELECT NULL, NULL NULL --
and a random link actually popped up going into that link
we actually found the flag and solved the challenge!
2
Are we up?
The hint was saying something about status of their website
on the bottom left we can press on this button and it will redirect us to another endpoint
we were told about another endpoint called /flag possibly the challenge and something about local when entering /flag we will obtain a fake flag
view page source
inside the source we found another endpoint again called /uptimer now shall go inside that web
and it brought us to a web availability monitoring tools knowing that i tried some stuff like going into webs and stuff so it seems like it will go to a web that we give to it but when we try to use localhost it will be blacklisted so we can bypass this using a redirect
Register on the platfrom and spawn the instances accordingly.
Author: Samarth @ark.dev
starting off the challenge we were greeted by an Advanced URL Scanner and its asking for an ip me as a webex guy immediately asked my self what if we tried to scan our own server how does the url scanner work?
so i set up my own request catcher using my favourite one
Register on the platfrom and spawn the instances accordingly.
Author: Abhinav @.0_0.ace.0_0.
checking the stats we can see that the wireshark is using tcp we can already suspect that the message is hidden in the tcp
there was a packet comment that was given from the probsetter so we can also suspect the other flag is inside another comment
we can use tshark to get this
5
Persist
User, “I logged onto my computer on FRIDAY and noticed something on the home screen before the computer shut down. Could it have been malware?”
Author: Parnika @parnika_maskar
before we start the challenge we have to understand the description first he says there was something on the home screen before the computer shutdown so knowing that we can suspect that the so called "malware" opened an app in his computer knowing that
usually last opened file data is saved in recentdocs recent docs is contained in this folder
Software > Microsoft > Windows > CurrentVersion > Explorer > RecentDocs
so i tried going inside the Recent docs from the HKCU to check for the current user
we can use reglookup to look inside the registry in linux
then cause of the huge data i asked deepseek to filter the useless data
as you can see we found the flag pattern and we solved the challenge
6
Chaos
You've stumbled upon a bunch of garbled nonsense—some might call them "encrypted messages," but who really knows? Most of it is just random junk, but hidden somewhere in this mess is an actual secret. No keys, no hints, just you and the chaos. Good luck figuring it out—if you even can.
Author: Abhinav @.0_0.ace.0_0.
the code above will take the text from a web then put it inside messages then it will clean the string from spaces and enters then it will open the real flag.txt file then it also cleans the extra spaces and enters and stores it to flag and append it to the message
then it will shuffle the messages making it hard to find the flag
then the text will be encrypted using xor
first it will convert the message to a sequence of bytes so we can modify it then it will over then we will xor the bytes using the i % 256
after xoring we will b85 encode the message
then we will write the output to a file called output.txt
after reading this code this is easily reversible
solver
first we decode the message so it will return to the bytes it was then we will put it in a sequence of bytes while xoring them again with their own i % 256 to get back the original bytes then we can return the decode()
import random
import base64
import os
messages = []
with open('https://x.com/Abhinav04139720.txt', 'rb') as f:
for line in f.readlines():
messages.append(line.strip())
with open('flag.txt', 'rb') as f:
flag = f.read().strip()
messages.append(flag)
random.shuffle(messages)
def xor_encrypt(msg):
transformed = bytearray(msg)
for i in range(len(transformed)):
transformed[i] ^= (i % 256)
return base64.b85encode(transformed).decode()
with open('output.txt', 'w') as f:
for msg in messages:
encrypted_msg = xor_encrypt(msg)
f.write(f'{encrypted_msg}\n\n')
import base64
def xor_decrypt(encrypted_msg):
decoded = base64.b85decode(encrypted_msg)
decrypted = bytearray()
for i in range(len(decoded)):
decrypted.append(decoded[i] ^ (i % 256))
return decrypted.decode()
with open('output.txt', 'r') as f:
lines = f.readlines()
for line in lines:
line = line.strip()
if line:
try:
decrypted = xor_decrypt(line)
print(f"Ciphertext: {line}")
print(f"Decrypted: {decrypted}")
print("-" * 40)
except Exception as e:
print(f"Error decrypting: {line}")
print(f"Error: {e}")
print("-" * 40)
