WebDecode

Platform: PicoCTF Category: Web Exploitation Environment: Standalone

Goal: a small site whose About page says to inspect it. The flag is in the markup, base64 encoded, parked in an attribute that means nothing to a browser.

Approach

The nav offers Home, About and Contact, so read the source of each in turn. Two of them are an ordinary brochure. The About page carries an attribute no browser has ever heard of.

about.html

<section class="about" notify_true="cGljb0NURnt3ZWJfc3VjYzNzc2Z1bGx5X2QzYzBkZWRfMWY4MzI2MTV9">

notify_true is the tell before the value is. class is doing real work on that element, and the attribute beside it is doing none, which makes it a place to keep something rather than a way to describe anything. The value then announces itself: any flag base64 encoded from its first byte opens cGljb0NURn, the ten characters picoCTF{ contributes on its own, and recognising them is faster than running the string through a detector.

Decoding it is a single pipe, and the whole page can be fetched rather than clicked through.

Bash

┌──(Idan@Kali)-[~/WebDecode]
└─> curl -s "http://titan.picoctf.net:55413/about.html" | grep -oE "cGl.*9" --color=none | base64 -d | sed -e '$a\'
<flag>

Flag picoCTF{web_succ3ssfully_d3c0ded_1f832615} Reveal

The 9 the pattern stops on is the last character of this flag’s encoding rather than anything the format guarantees, so it holds only for a flag whose length is a multiple of three. The sed appends the newline base64 -d does not emit, so the next prompt does not open on the flag’s line.

The port belongs to a launched instance, so :55413 is long gone even though titan.picoctf.net still resolves. The flag does not follow the port: a later instance, on a different port, served this same 1f832615.

Why it works

An HTML parser does not check attribute names against a list. Anything shaped like a name is accepted, stored on the element, and then ignored by rendering, which is precisely the behaviour data-* attributes were later standardised to formalise rather than introduce. So the value was delivered in full to every visitor and never had a chance of appearing on screen, which is a different thing from being withheld.

Base64 does the rest, and it is worth naming what that work is not. It is an encoding, not a cipher: there is no key, so it defeats a reader skimming for picoCTF{ and nothing else.