Challenge Overview
| Field | Value |
|---|---|
| Name | Open Secrets |
| Category | Web |
| Difficulty | Easy |
| Target | http://<target_ip>:<port> |
| Concept | Flag hardcoded directly in the page source |
Flag
| Type | Value |
|---|---|
| Challenge flag | [REDACTED] |
Analysis
- Opened the web app by IP.
- Viewed the page source, focusing on the Index page.
Exploitation
The flag is hardcoded directly in the source — no vulnerability chain required; just read the source.
Step 1 — View source
Right-click → View Page Source (or curl http://<target_ip>:<port>/), and read the index/Index page source.
Result
FLAG FOUND — hardcoded in the HTML/JS source.
Techniques Demonstrated
- Source-code disclosure / hardcoded secret
Tools Used
Browser (view-source) or curl
← all writeups