112 - Умный переулок (Smart Alley)

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: api_versioning_exploit, frame_extraction

Summary

Walkthrough of the CUSTOM Web 112 - Умный переулок (Smart Alley). Task: Investigate the Smart Alley system to access video recordings and find hidden information. Solution: Exploited deprecated API v1 endpoint with broken access control to obtain video file, then us

Description

Investigating the "Smart Alley" system. The goal is to gain access to video recordings and find hidden information.

Analysis

While examining the web application at http://tasks.duckerz.ru:30074/, two API versions were discovered: v1 and v2.

• API v2: Has strict access control checks. Regular users cannot view videos.
• API v1: Contains the /api/v1/video endpoint which returns the path to the video file without proper authorization checks (Broken Access Control). ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

1. API Exploitation

Accessing the deprecated endpoint allowed obtaining a direct link to the video file: video_ad4340306e925f588e4beef5ff9d4d6f.mp4

2. Video Forensics

While watching the video, at the 43-second mark a person with a white sign was noticed. For detailed analysis, ffmpeg and ImageMagick tools were used.

Extracting frames in the target appearance interval (38-48 sec):

 bash read-only • copy allowed Copy
ffmpeg -i video_ad4340306e925f588e4beef5ff9d4d6f.mp4 -ss 00:00:38 -to 00:00:48 -vf "fps=10" frames/out%04d.png

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

After processing the frames and improving readability, the flag text was read piece by piece from the sign: DUCKERZ, {v1deo_, fl4g}. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering api_versioning_exploit, frame_extraction was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-01-09 • CUSTOM • 112 - Умный переулок (Smart Alley) • Difficulty: Medium